Zcash Zebra EUVD-2026-91438

Exploitation requires the attacker to act as a network peer and deliver a coinbase-malleated block that shares a legitimate canonical block's hash to the target Zebra node BEFORE the canonical block propagates - a race-condition timing window reflected in AC:H and AT:P. No authentication is required (PR:N, unauthenticated peers), and no user interaction is needed (UI:N), but the narrow pre-propagation timing window and the need to produce a hash-colliding malleated block materially limit reliable, on-demand exploitation. Impact is confined to availability: the node stalls synchronization for roughly 2,000 blocks; there is no confidentiality or integrity impact. Affects all Zebra versions before 6.1.0; upgrading to 6.1.0 remediates.

The CVSS 4.0 vector (CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N) describes a network-reachable, unauthenticated flaw whose only impact is availability (VA:H; VC:N/VI:N/VA:H), i.e. a denial-of-service chain-stall rather than any data exposure or integrity loss. Two metrics meaningfully dampen the 8.2 score in practice: AC:H and AT:P indicate the attacker must win a timing race, delivering a coinbase-malleated block that shares a canonical block's hash BEFORE that canonical block propagates - a non-trivial, non-repeatable-on-demand condition. There is no EPSS score, no CISA KEV listing, and no POC referenced in the provided data, so this is no public exploit identified at time of analysis; the risk is theoretical-but-credible, not actively exploited. CONFLICT TO NOTE: the input Tags include 'Information Disclosure', which directly contradicts the CVSS vector (VC:N, confidentiality impact is None) and the description (a synchronization stall) - this is a mislabeling, not an information-disclosure bug. Net: a genuine availability/integrity-of-sync concern for Zebra operators worth patching to 6.1.0, but the attack-complexity and timing prerequisites make opportunistic mass exploitation unlikely; prioritize based on node criticality rather than treating it as an internet-wide emergency.

A malicious peer on the Zcash P2P network crafts a block that is coinbase-malleated yet collides on the canonical block's hash, and races to deliver it to a target Zebra node before the legitimate canonical block propagates. The poisoned parent_error_map entry then causes the node to reject the next canonical block, stalling synchronization for roughly 2,000 blocks. No public exploit code is referenced, and the required pre-propagation timing window (AC:H/AT:P) makes reliable exploitation difficult.