CVE-2026-104430

Summary

Zebra nodes incorrectly count signature operations in P2SH redeem scripts, overcounting multisig signatures by 20 sigops each when they should use Zcash's accurate P2SH mode instead of legacy mode. This causes a consensus divergence where valid blocks accepted by zcashd are rejected by Zebra nodes, leading to chain stalls.

Exploitability

Exploitation is relatively straightforward for remote attackers who can broadcast specially crafted P2SH spends using low-threshold multisig redeem scripts that exceed Zebra's inflated MAX_BLOCK_SIGOPS count, requiring no authentication or special preconditions.

Blast radius

The impact could be significant as it would cause Zebra nodes to reject valid blocks from zcashd, potentially leading to chain forks or complete network stall if enough nodes are running Zebra software.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to Zebra zebrad 4.5.1 or later and zebra-script 7.0.1 or later to fix the P2SH signature operation counting issue.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.