CVE-2026-40880

OVERVIEW CVE-2026-40880 is a consensus vulnerability affecting ZEBRA, a Rust-based Zcash node implementation. A logic error in the transaction verification cache could allow malicious miners to trigger consensus splits by submitting transactions valid at one block height but invalid at the next, then mining them into blocks at the later height. Affected versions include zebrad prior to 4.3.1 and zebra-consensus prior to 5.0.2. SEVERITY The vulnerability requires active exploitation by a network miner with the ability to craft and mine blocks containing specific invalid transactions, indicating moderate attack complexity. The potential impact is severe from a blockchain integrity perspective, as successful exploitation would cause vulnerable nodes to diverge from the legitimate Zcash network consensus, undermining the security and reliability of the distributed ledger. However, EPSS scoring (0.00042) suggests low practical exploit probability in real-world scenarios. EXPLOITATION STATUS There is no evidence of active exploitation in the wild, with KEV status marked as inactive and no known publicly available exploit code. Community attention appears minimal given the low FAUCET risk score of 37/100, suggesting either successful patch adoption or limited affected infrastructure. Organizations running vulnerable versions should prioritize patching to versions 4.3.1 and newer to eliminate this consensus-level risk.