Vulnerability · Published Aug 5, 2025 · Assigned by GitHub_M

CVE-2025-54873RISC Zero Underconstrained Vulnerability: Division

Low 2.7

In plain English

A low-severity security flaw in risc0 from risc0. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities).

Severity (CVSS 4.0)2.7Low

Exploit odds (30 days)0.4%top 61.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

RISC Zero is a zero-knowledge verifiable general computing platform based on zk-STARKs and the RISC-V microarchitecture. RISC packages risc0-zkvm versions 2.0.0 through 2.1.0 and risc0-circuit-rv32im and risc0-circuit-rv32im-sys versions 2.0.0 through 2.0.4 contain vulnerabilities where signed integer division allows multiple outputs for certain inputs with only one being valid, and division by zero results are underconstrained. This issue is fixed in risc0-zkvm version 2.2.0 and version 3.0.0 for the risc0-circuit-rv32im and risc0-circuit-rv32im-sys packages.

Affected products (as reported)

Vendor	Product	Versions
risc0	risc0	>= 2.0.0, < 2.2.0

Weakness: CWE-369 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U

References

https://github.com/risc0/risc0/security/advisories/GHSA-f6rc-24x4-ppxp x_refsource_CONFIRM
https://github.com/risc0/risc0/pull/3235 x_refsource_MISC
https://github.com/risc0/zirgen/pull/249 x_refsource_MISC