CVE-2025-61588
BaseFortify
Publication date: 2025-10-02
Last updated on: 2025-10-02
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| risc0 | risc0-zkvm-platform | 2.1.0 |
| risc0 | risc0-aggregation | 0.9 |
| risc0 | risc0-zkvm | 2.3.2 |
| risc0 | risc0-zkvm | 3.0.3 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in risc0-zkvm-platform versions 2.0.2 and below, where when the zkVM guest calls sys_read, the host can craft a response that writes to an arbitrary memory location in the guest. This allows the host to execute arbitrary code within the guest, compromising the soundness guarantees of the guest program. All guest programs built with the affected versions are vulnerable.
How can this vulnerability impact me? :
The vulnerability allows an attacker controlling the host to execute arbitrary code within the guest environment. This can lead to a complete compromise of the guest program's integrity and security, potentially allowing unauthorized actions, data manipulation, or further exploitation within the affected system.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately upgrade affected packages to the fixed versions: risc0-zkvm-platform to 2.1.0 or later, risc0-zkos-v1compat to 2.1.0 or later, risc0-aggregation to 0.9 or later, and risc0-zkvm to 2.3.2 or 3.0.3 or later. Avoid using vulnerable versions (2.0.2 and below for risc0-zkvm-platform, below 2.1.0 for risc0-zkos-v1compat, below 0.9 for risc0-aggregation, and between 3.0.0-rc.1 and 3.0.1 for risc0-zkvm).