CVE-2026-35679 is a vulnerability in the Zcash zcashd client prior to version 6.12.0 where the software sometimes fails to verify Sprout proofs correctly. This improper implementation of security checks (CWE-358) allows certain invalid transactions to be accepted, which could potentially result in unauthorized draining of funds from the Sprout pool. The vulnerability has a CVSS 3.1 base score of 3.5, indicating low severity with network attack vector, high attack complexity, low privileges required, no user interaction, and a scope change. No official patch or remediation level is currently documented, and no known exploits are reported in the wild.

The vulnerability could allow attackers to submit invalid transactions that bypass Sprout proof verification, potentially leading to unauthorized fund withdrawals from the Sprout pool. However, the impact is limited to integrity (transaction acceptance) without confidentiality or availability effects. The low CVSS score reflects the complexity and limited scope of the issue.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is documented, users should monitor Zcash project communications for updates and apply any forthcoming patches promptly. Until then, caution is advised when interacting with Sprout pool transactions on affected versions.