Zero-Knowledge Verifiable Computing Vulnerability in RISC Zero Platform

CVE-2025-52884

What is CVE-2025-52884?

The Steel Solidity library in the RISC Zero platform, prior to versions 2.1.1 and 2.2.0, contains a flaw where the Steel.validateCommitment function incorrectly validates crafted commitments with a zero digest. This error undermines the expected semantics of the function, as it should enforce commitments corresponding to valid blocks in the chain. A zero digest indicates that the commitment does not link to any existing block, allowing theoretically incorrect operations that compromise program soundness if additional exploits or misuse of the library occur. Users of versions 2.1.0 or earlier are advised to ensure correct usage of the library by validating zkVM proofs alongside commitment checks to maintain security standards.

References