CVE-2026-46654: high-severity vulnerability in Plonky3
Plonky3 MultiField32Challenger: transcript malleability and challenge entropy loss
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Plonky3's cryptographic challenger can be manipulated to generate identical challenges from different transcripts, undermining the security guarantee that prevents attackers from forging proofs. This breaks the mathematical foundation that makes Fiat-Shamir hashing trustworthy.
An attacker controlling prover observations can exploit transcript malleability in MultiField32Challenger to create distinct transcripts yielding identical challenges, violating the binding property of Fiat-Shamir. The vulnerability stems from insufficient challenge entropy derivation, allowing an adversary to forge valid proofs by manipulating transcript inputs before the hash-based challenge generation.