CVE-2019-7167General(z.cash / zcash)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch z.cash zcash systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Zcash, before the Sapling network upgrade (2018-10-28), had a counterfeiting vulnerability. A key-generation process, during evaluation of polynomials related to a to-be-proven statement, produced certain bypass elements. Availability of these elements allowed a cheating prover to bypass a consistency check, and consequently transform the proof of one statement into an ostensibly valid proof of a different statement, thereby breaking the soundness of the proof system. This misled the original Sprout zk-SNARK verifier into accepting the correctness of a transaction.

z.cash CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

Other references

Weakness type (CWE)

CWE-754

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

zcash

Threat summary

Patch or workaround signal is available
6 mentions across 6 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 2 signals
Technical details provided in 2 signals
General: 3 classified signals
Disclosure: 1 classified signal
Peaked 5d ago at 1 mentions (2026-06-03); latest day: 1
6 total mentions across 6 days

Affected systems

Vendors

z.cash

Products

zcash

Deep dive

Activity timeline6 mentions / 6d

Signal classification3 categories

General

350.0%

Patch

233.3%

Disclosure

116.7%

Classification over time

Date	Total	Labels

2026-06-03	1	Patch1
2026-06-05	1	General1
2026-06-09	1	General1
2026-06-17	1	Disclosure1
2026-06-20	1	General1
2026-09-17	1	Patch1

Full discourse6 posts

Exitnode_@exitnode_137d
Patch
I genuinely do not get the psyop around Zcash. This guy tries to reference "moneros inflation bug" which hasnt happened in almost a decade. Here's a list of recent $ZEC exploits and bugs: March 1, 2018: BCTV14 zk-SNARK counterfeiting vulnerability (CVE-2019-7167) discovered (infinite counterfeit ZEC possible in Sprout pool). October 28, 2018: Sapling upgrade fixes the 2018 counterfeiting vulnerability. September 13, 2019: Security issue reported . November 8, 2019: CVE-2017-18350 response and "related fixes. " February 6, 2020: Sprout z-address wallet balance display bug. February 6, 2020: Consensus fork vulnerability. July 28, 2020: Sprout verification vulnerability introduced (bypass of proof checks). March 23, 2026: Sprout verification vulnerability disclosed (~25k ZEC counterfeiting risk; March 31, 2026). April 4, 2026: Multiple zcashd/Zebra issues reported (Orchard crashes, consensus gaps, turnstile bypass, integer issues). April 17, 2026: zcashd v6.12.1 and Zebra v4.3.1 fixes for the April bundle (including CVE-2026-34377 and others). May 2, 2026: Zebra v4.4.0 critical fixes (consensus, DoS, sigops undercount). May 29, 2026: Orchard shielded pool double-spending risk discovered. June 2–3, 2026: Emergency soft/hard fork for Orchard fix. This focuses on publicly notable/security-relevant issues; many minor bugs exist in routine updates but lack specific dated disclosures.
Post summary
The text enumerates several Zcash CVEs, their discovery dates, and corresponding patch releases, but does not mention PoC code or active exploitation.
2212761.8K
2.3K followersView on X
TK@iTrapKeys135d
General
ask yourself: how much ineptitude is the @Zcash community willing to tolerate? 🤔 this is NOT the first “we don’t think the double spend glitch was exploited” moment. never forget the mess CVE-2019-7167 left on the chart. look out below! https://t.co/Q2j5v9KwdS
Post summary
The tweet references CVE‑2019‑7167 and asserts no exploitation, but provides no PoC, exploit code, patch instructions, or technical details.
000160672
805 followersView on X
Odysseus🛡️@zheOdysseus120d
General
On February 5, 2019 it was finally made public, 11 months after Curaçao. So was CVE-2019-7167 ever exploited? Extremely unlikely as the pool still holds 25000 zec. However similarly to Orchard we can't verifiably prove it wasn't. https://t.co/z5URiwOkWo
Post summary
The tweet discusses CVE-2019-7167 and speculates on its exploitation likelihood, but it lacks concrete details, proof of exploitation, or remediation information.
10020138
23 followersView on X
Odysseus🛡️@zheOdysseus123d
Disclosure
In 2018, the fear behind all this became less theoretical. @rel_zeta_tech found CVE-2019-7167 in the original BCTV14-based construction. The problem was that the setup transcript contained extra bypass elements. So With the right transcript data, a malicious prover could route around a consistency check and turn a proof of one statement into a proof of another. ECC says it found no evidence of counterfeiting and believes none occurred.
Post summary
CVE-2019-7167 was identified in a BCTV14-based construction, exposing a consistency‑check bypass, but no evidence of exploitation or counterfeiting has been observed.
10010209
19 followersView on X
Lyrie.ai@lyrie_ai132d
General
CVE-2019-7167. Source: X search for CVE-2026 critical Posted: 2026-06-03T18:26:43.000Z Likes: 14
Post summary
The post only mentions CVE-2019-7167 without providing any additional context, details, or actionable information.
1000033
258 followersView on X
Kuncoro@0xkuncoro31d
Patch
@heart_ The record makes your point sharper: found 1 March 2018, patched silently by Sapling on 28 October, disclosed only 5 February 2019 as CVE-2019-7167. Eight months of quiet fixing, kept even from their own engineers. The whole detector was the Sprout pool staying above zero.
Post summary
The text focuses on the timeline of CVE-2019-7167, stating it was found in March 2018, silently patched by Sapling in October, and disclosed in February 2019. The clearest indicator is the mention of an applied patch rather than PoC, exploit, or active exploitation.
00000800
126 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	z.cash	zcash	-	-	-

Explore more

Back to dashboard z.cash CVEs zcash vulnerabilities

What researchers are saying

CVE-2019-7167

Exitnode_[verified]@exitnode_Patch

The text enumerates several Zcash CVEs, their discovery dates, and corresponding patch releases, but does not mention PoC code or active exploitation.

TK[verified]@iTrapKeysGeneral

The tweet references CVE‑2019‑7167 and asserts no exploitation, but provides no PoC, exploit code, patch instructions, or technical details.

Odysseus🛡️[verified]@zheOdysseusGeneral

The tweet discusses CVE-2019-7167 and speculates on its exploitation likelihood, but it lacks concrete details, proof of exploitation, or remediation information.

Odysseus🛡️[verified]@zheOdysseusDisclosure

CVE-2019-7167 was identified in a BCTV14-based construction, exposing a consistency‑check bypass, but no evidence of exploitation or counterfeiting has been observed.

Lyrie.ai[verified]@lyrie_aiGeneral

The post only mentions CVE-2019-7167 without providing any additional context, details, or actionable information.

Kuncoro[verified]@0xkuncoroPatch

The text focuses on the timeline of CVE-2019-7167, stating it was found in March 2018, silently patched by Sapling in October, and disclosed in February 2019. The clearest indicator is the mention of an applied patch rather than PoC, exploit, or active exploitation.