Loading...
Skip to main content
GeekWala

CVE-2025-54873 — Vulnerability in risc0-circuit-rv32im-sys — CVE...

LOW

RISC Zero Underconstrained Vulnerability: Division

Published August 5, 2025Updated August 6, 2025Source: osv

Summary

Two issues were found: For some inputs to signed integer division, the circuit allowed two outputs, only one of which was valid. Additionally, the result of division by zero was underconstrained. This vulnerability was identified using the Picus tool from Veridise. Impacted on-chain verifiers have already been disabled via the estop mechanism outlined in the [Verifier Management Design](https://github.com/risc0/risc0-ethereum/blob/release-2.0/contracts/version-management-design.md#base-verifier-implementations). ## Mitigation We recommend all impacted users upgrade as soon as possible. Rust applications using the `risc0-zkvm` crate at versions < 2.2 should upgrade to version 2.2.0 or later. Smart contract applications using the official [RISC Zero Verifier Router](https://dev.risczero.com/api/blockchain-integration/contracts/verifier#verifier-router) do not need to take any action: zkVM version 2.2 is active on all official routers, and version 2.1 has been disabled. Smart contract applications not using the verifier router should update their contracts to send verification calls to the 2.2 version of the verifier.

Advisory Timeline

  • First published August 5, 2025 (433 days ago).
  • Last revised August 6, 2025 — 1 day after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Cargo
Update risc0-circuit-rv32im-sys to 3.0.0 or later
cargo update -p risc0-circuit-rv32im-sys --precise 3.0.0
Cargo
Update risc0-circuit-rv32im to 3.0.0 or later
cargo update -p risc0-circuit-rv32im --precise 3.0.0
Cargo
Update risc0-zkvm to 2.2.0 or later
cargo update -p risc0-zkvm --precise 2.2.0

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (3)

Affects 1 ecosystem: crates.io (3).

PackageEcosystemAffectedFixed In
risc0-circuit-rv32im-sys
crates.io
All versions3.0.0
risc0-circuit-rv32im
crates.io
All versions3.0.0
risc0-zkvm
crates.io
All versions2.2.0

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 6.5 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
—
Confidentiality
—
Integrity
—
Availability
—

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U

References

Frequently Asked Questions

What is CVE-2025-54873?
RISC Zero Underconstrained Vulnerability: Division This vulnerability has been assigned a severity rating of LOW (CVSS score: 6.5/10).
How do I check if my project is affected by CVE-2025-54873?
CVE-2025-54873 affects risc0-circuit-rv32im-sys, risc0-circuit-rv32im and risc0-zkvm. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2025-54873 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
6.5

Exploitation requires specific conditions or has limited impact. Remediate within weeks.

Also Known As

GHSA-f6rc-24x4-ppxp

Related CVEs

  • CVE-2025-61588
    CRITICAL

    risc0 vulnerable to arbitrary code execution in guest via memory safety failure in `sys_read`

  • CVE-2026-54786
    LOW

    Wasmtime has a leak in WASIp1 `fd_renumber` implementation

  • CVE-2026-41677
    LOW

    rust-opennssl has an Out-of-bounds read in PEM password callback when returning an oversized length

More crates.io advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies