CVE-2025-54873 - RISC Zero Underconstrained Vulnerability: Division

Back Back to CVE browser

LOW

RISC Zero Underconstrained Vulnerability: Division

Published Aug 5, 2025

2.7

LOW

CVSS 4.0

EPSS 0.39%

Description

RISC Zero is a zero-knowledge verifiable general computing platform based on zk-STARKs and the RISC-V microarchitecture. RISC packages risc0-zkvm versions 2.0.0 through 2.1.0 and risc0-circuit-rv32im and risc0-circuit-rv32im-sys versions 2.0.0 through 2.0.4 contain vulnerabilities where signed integer division allows multiple outputs for certain inputs with only one being valid, and division by zero results are underconstrained. This issue is fixed in risc0-zkvm version 2.2.0 and version 3.0.0 for the risc0-circuit-rv32im and risc0-circuit-rv32im-sys packages.

Affected products

Vendor Risc0 Product Risc0 Default
n/a
- Version
  >= 2.0.0, < 2.2.0
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Risc0

n/a

Version	Status	Constraints
>= 2.0.0, < 2.2.0	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-369

References (6)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-23666
Advisory
https://github.com/advisories/GHSA-f6rc-24x4-ppxp
Advisory
https://github.com/risc0/risc0/pull/3235
x_refsource_MISC
https://github.com/risc0/risc0/security/advisories/GHSA-f6rc-24x4-ppxp
x_refsource_CONFIRM
https://github.com/risc0/zirgen/pull/249
x_refsource_MISC
https://nvd.nist.gov/vuln/detail/CVE-2025-54873

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-23666		Advisory
https://github.com/advisories/GHSA-f6rc-24x4-ppxp		Advisory
https://github.com/risc0/risc0/pull/3235		x_refsource_MISC
https://github.com/risc0/risc0/security/advisories/GHSA-f6rc-24x4-ppxp		x_refsource_CONFIRM
https://github.com/risc0/zirgen/pull/249		x_refsource_MISC
https://nvd.nist.gov/vuln/detail/CVE-2025-54873