CVE-2025-54873 - CVE House
Back to Database
Status published Low CVE-2025-54873

RISC Zero Underconstrained Vulnerability: Division

Vulnerability Description

RISC Zero is a zero-knowledge verifiable general computing platform based on zk-STARKs and the RISC-V microarchitecture. RISC packages risc0-zkvm versions 2.0.0 through 2.1.0 and risc0-circuit-rv32im and risc0-circuit-rv32im-sys versions 2.0.0 through 2.0.4 contain vulnerabilities where signed integer division allows multiple outputs for certain inputs with only one being valid, and division by zero results are underconstrained. This issue is fixed in risc0-zkvm version 2.2.0 and version 3.0.0 for the risc0-circuit-rv32im and risc0-circuit-rv32im-sys packages.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-54873

Credits & Attribution

No credits recorded in the NVD database.

References

More from risc0

View All →
CVE-2025-61588
risc0 vulnerable to arbitrary code execution in guest via memory safety failure in `sys_read`
Critical 9.3
CVE-2025-52884
risc0-ethereum-contracts allows invalid commitment with digest value of zero to be accepted by Steel.validateCommitment
Low 1.7
CVE-2025-52484
RISC Zero zkVM Underconstrained Vulnerability
Low 2.7

Affected Vendor

Affected Software

risc0
Vulnerable Versions:
>= 2.0.0, < 2.2.0

Timeline

Official Publish: August 5th, 2025
Last Modified: August 6th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-369

MITRE ATT&CK TTPs

T1203 Exploitation for Client Execution
Execution
T1499.003 Application Exhaustion Flood
Impact