Arbitrary Code Execution Vulnerability in RISC Zero's Computing Platform

CVE-2025-61588

What is CVE-2025-61588?

RISC Zero's computing platform, which employs zk-STARKs and the RISC-V microarchitecture, is susceptible to a vulnerability in its risc0-zkvm-platform. In versions up to 2.0.2, the sys_read function can be exploited by a host, enabling it to send a manipulated response that writes to any memory location within the guest environment. This flaw permits the execution of arbitrary code, significantly jeopardizing the integrity of guest programs utilizing the affected versions. Additional vulnerable components include risc0-aggregation (versions below 0.9), risc0-zkos-v1compat (versions below 2.1.0), and specific versions of risc0-zkvm between 3.0.0-rc.1 and 3.0.1. The issue has been rectified in the subsequent releases: risc0-zkvm-platform 2.1.0, risc0-zkos-v1compat 2.1.0, risc0-aggregation 0.9, and risc0-zkvm 2.3.2 and 3.0.3.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References