CVE-2025-54873

LOW

risc0-zkvm 2.0.0-2.1.0 - Integer Division Mismatch and Divide By Zero

Title source: llm
STIX 2.1

Description

RISC Zero is a zero-knowledge verifiable general computing platform based on zk-STARKs and the RISC-V microarchitecture. RISC packages risc0-zkvm versions 2.0.0 through 2.1.0 and risc0-circuit-rv32im and risc0-circuit-rv32im-sys versions 2.0.0 through 2.0.4 contain vulnerabilities where signed integer division allows multiple outputs for certain inputs with only one being valid, and division by zero results are underconstrained. This issue is fixed in risc0-zkvm version 2.2.0 and version 3.0.0 for the risc0-circuit-rv32im and risc0-circuit-rv32im-sys packages.

References (3)

Core 3
Core References
Issue Tracking x_refsource_misc
https://github.com/risc0/risc0/pull/3235
Issue Tracking x_refsource_misc
https://github.com/risc0/zirgen/pull/249

Scores

CVSS v4 2.7
EPSS 0.0035
EPSS Percentile 26.3%
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-369
Status published
Products (4)
crates.io/risc0-circuit-rv32im 2.0.0 - 3.0.0crates.io
crates.io/risc0-circuit-rv32im-sys 2.0.0 - 3.0.0crates.io
crates.io/risc0-zkvm 2.0.0 - 2.2.0crates.io
risc0/risc0 >= 2.0.0, < 2.2.0
Published Aug 06, 2025
Tracked Since Feb 18, 2026