Read the docs
TI-2025-34607 Aliases CVE-2025-54873GHSA-f6rc-24x4-ppxp

RISC Zero Underconstrained Vulnerability: Division

Priority LOW 20CWE-369Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-369.

Summary

RISC Zero is a zero-knowledge verifiable general computing platform based on zk-STARKs and the RISC-V microarchitecture. RISC packages risc0-zkvm versions 2.0.0 through 2.1.0 and risc0-circuit-rv32im and risc0-circuit-rv32im-sys versions 2.0.0 through 2.0.4 contain vulnerabilities where signed integer division allows multiple outputs for certain inputs with only one being valid, and division by zero results are underconstrained. This issue is fixed in risc0-zkvm version 2.2.0 and version 3.0.0 for the risc0-circuit-rv32im and risc0-circuit-rv32im-sys packages.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0044 38th percentileScored 2026-11-07
Fix Fixed risc0 (risc0): 2.2.0risc0-zkvm (crates.io): 2.2.0+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
risc0risc02.0.0 to before 2.2.02.2.0Patch availableCNA
—risc0-zkvm (crates.io)2.0.0 to before 2.2.02.2.0Patch availableGHSA-f6rc-24x4-ppxp
—risc0-circuit-rv32im (crates.io)2.0.0 to before 3.0.03.0.0Patch availableGHSA-f6rc-24x4-ppxp
—risc0-circuit-rv32im-sys (crates.io)2.0.0 to before 3.0.03.0.0Patch availableGHSA-f6rc-24x4-ppxp
  • risc0 Vendorrisc0 Affected 2.0.0 to before 2.2.0 Fixed in 2.2.0 Patch available CNA
  • risc0-zkvm (crates.io) Vendor— Affected 2.0.0 to before 2.2.0 Fixed in 2.2.0 Patch available GHSA-f6rc-24x4-ppxp
  • risc0-circuit-rv32im (crates.io) Vendor— Affected 2.0.0 to before 3.0.0 Fixed in 3.0.0 Patch available GHSA-f6rc-24x4-ppxp
  • risc0-circuit-rv32im-sys (crates.io) Vendor— Affected 2.0.0 to before 3.0.0 Fixed in 3.0.0 Patch available GHSA-f6rc-24x4-ppxp

Remediation

  • Fix · CNA risc0 (risc0) Fixed in 2.2.0
  • Fix · GHSA-f6rc-24x4-ppxp risc0-zkvm (crates.io) Fixed in 2.2.0 Advisory →
  • Fix · GHSA-f6rc-24x4-ppxp risc0-circuit-rv32im (crates.io) Fixed in 3.0.0 Advisory →
  • Fix · GHSA-f6rc-24x4-ppxp risc0-circuit-rv32im-sys (crates.io) Fixed in 3.0.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-54873
  2. 2026-10-03 Alias added: GHSA-f6rc-24x4-ppxp

References

Advisory 1

Other 4

  • TI-2025-38034 risc0 vulnerable to arbitrary code execution in guest via memory safety failure in `sys_read` CVSS 4.0CRITICAL 9.3
  • TI-2025-32920 risc0-ethereum-contracts allows invalid commitment with digest value of zero to be accepted by Steel.validateCommitment CVSS 4.0LOW 1.7
  • TI-2025-32610 RISC Zero zkVM Underconstrained Vulnerability CVSS 4.0LOW 2.7

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences