CVE-2025-54873 json
RISC Zero Underconstrained Vulnerability: Division
published last yr. modified 4mo ago also GHSA-f6rc-24x4-ppxp , EUVD-2025-23666
- cvss
- 2.7
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 38%
- public exploits
- 0
- none known
Summary
RISC Zero is a zero-knowledge verifiable general computing platform based on zk-STARKs and the RISC-V microarchitecture. RISC packages risc0-zkvm versions 2.0.0 through 2.1.0 and risc0-circuit-rv32im and risc0-circuit-rv32im-sys versions 2.0.0 through 2.0.4 contain vulnerabilities where signed integer division allows multiple outputs for certain inputs with only one being valid, and division by zero results are underconstrained. This issue is fixed in risc0-zkvm version 2.2.0 and version 3.0.0 for the risc0-circuit-rv32im and risc0-circuit-rv32im-sys packages.
Patch / fix
- crates.io risc0-zkvm 2.2.0
- crates.io risc0-circuit-rv32im 3.0.0
- crates.io risc0-circuit-rv32im-sys 3.0.0
- github.com/risc0/risc0#3235 pull request
- github.com/risc0/zirgen#249 pull request
Is CVE-2025-54873 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
0.44% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 2.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U |
| CNA | 4.0 | 2.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| crates.io | risc0-zkvm | >=2.0.0, <2.2.0 |
2.2.0 |
| crates.io | risc0-circuit-rv32im | >=2.0.0, <3.0.0 |
3.0.0 |
| crates.io | risc0-circuit-rv32im-sys | >=2.0.0, <3.0.0 |
3.0.0 |
Affected products
- risc0 risc0
Classification
- Weakness
-
- CWE-369 Divide By Zero
References
Sources
- CVE List CVE-2025-54873
- GitHub Advisory GHSA-f6rc-24x4-ppxp
- NVD CVE-2025-54873
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.