CVE-2025-54873
BaseFortify
Publication date: 2025-08-06
Last updated on: 2025-08-06
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| risc0 | risc0-circuit-rv32im-sys | 2.1 |
| risc0 | risc0-zkvm | 2.2 |
| risc0 | risc0-circuit-rv32im-sys | 2.2 |
| risc0 | risc0-circuit-rv32im | 2.0 |
| risc0 | risc0-zkvm | 2.1 |
| risc0 | risc0-circuit-rv32im | 2.1 |
| risc0 | risc0-zkvm | 2.0 |
| risc0 | risc0-circuit-rv32im | 2.2 |
| risc0 | risc0-circuit-rv32im-sys | 2.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-369 | The product divides a value by zero. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects RISC Zero's risc0-zkvm and related circuit packages, where signed integer division operations can produce multiple outputs for certain inputs, but only one output is valid. Additionally, division by zero results are underconstrained, meaning the system does not properly handle or restrict these cases. This can lead to incorrect or ambiguous computation results in the zero-knowledge verifiable computing platform.
How can this vulnerability impact me? :
The vulnerability can impact users by causing incorrect or ambiguous outputs in computations that rely on signed integer division within the affected RISC Zero packages. This undermines the reliability and correctness of zero-knowledge proofs generated by the platform, potentially leading to trust issues or incorrect verification results.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, upgrade risc0-zkvm to version 2.2.0 or later, and upgrade risc0-circuit-rv32im and risc0-circuit-rv32im-sys packages to version 3.0.0 or later.