PT-2025-32005 · Risc Zero · Risc0-Circuit-Rv32Im+2

Veridiseaudits · Published 2025-08-05 · Updated 2025-08-06 · CVE-2025-54873

Positive Technologies (AI Summary)

CVSS v4.0

2.7

Low

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U

Name of the Vulnerable Software and Affected Versions risc0-zkvm versions 2.0.0 through 2.1.0 risc0-circuit-rv32im versions 2.0.0 through 2.0.4 risc0-circuit-rv32im-sys versions 2.0.0 through 2.0.4

Description RISC Zero is a zero-knowledge verifiable general computing platform based on zk-STARKs and the RISC-V microarchitecture. The risc0-zkvm, risc0-circuit-rv32im, and risc0-circuit-rv32im-sys packages contain an issue where signed integer division allows multiple outputs for certain inputs, with only one being valid. Division by zero results are also underconstrained.

Recommendations Update to risc0-zkvm version 2.2.0 or later. Update to risc0-circuit-rv32im version 3.0.0 or later. Update to risc0-circuit-rv32im-sys version 3.0.0 or later.

Exploit

Fix

Divide By Zero

Weakness Enumeration

CWE-369

Related Identifiers

CVE-2025-54873

GHSA-F6RC-24X4-PPXP

Affected Products

Risc0-Circuit-Rv32Im

Risc0-Circuit-Rv32Im-Sys

Risc0-Zkvm

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/54xxx/CVE-2025-54873.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-54873 · Security Note
• https://osv.dev/vulnerability/GHSA-f6rc-24x4-ppxp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-54873 · Vendor Advisory
• https://github.com/risc0/risc0 · Note
• https://github.com/risc0/risc0/security/advisories/GHSA-f6rc-24x4-ppxp · Note
• https://github.com/risc0/risc0/pull/3235 · Note
• https://github.com/risc0/zirgen/pull/249 · Note
• https://twitter.com/CVEnew/status/1952880932341620862 · Twitter Post