Vulnerability in RISC Zero's zk-STARKs Computing Platform for RISC-V Microarchitecture
CVE-2025-52484

2.7LOW

Key Information:

Vendor

Risc0

Status
Risc0
Vendor
CVE Published:
20 June 2025

What is CVE-2025-52484?

A vulnerability has been identified in the RISC Zero zk-STARKs computing platform, particularly affecting the rv32im circuit. This issue allows a malicious prover to exploit any 3-register RISC-V instruction, such as remu and divu, leading to confusion between the values of the rs1 and rs2 registers. Versions 2.0.0, 2.0.1, and 2.0.2 of the risc0-zkvm are impacted, necessitating an upgrade to version 2.1.0 for Rust applications utilizing the risc0-zkvm crate. Smart contract applications using the RISC Zero Verifier Router are automatically secure, as zkVM version 2.1 is operational while version 2.0 has been deactivated. However, contracts not using the router must be updated to direct verification calls to the latest version for enhanced security.

Affected Version(s)

risc0 >= 2.0.0, < 2.1.0

References

https://github.com/risc0/risc0/security/advisories/GHSA-g...
x_refsource_CONFIRM
https://github.com/risc0/risc0/pull/3181
x_refsource_MISC
https://github.com/risc0/zirgen/pull/238
x_refsource_MISC

CVSS V4

Score:
2.7
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-52484 : Vulnerability in RISC Zero's zk-STARKs Computing Platform for RISC-V Microarchitecture