CVE-2025-61588 (GCVE-0-2025-61588)

Vulnerability from cvelistv5 – Published: 2025-10-01 23:30 – Updated: 2025-10-02 18:01

Title

risc0 vulnerable to arbitrary code execution in guest via memory safety failure in `sys_read`

Summary

RISC Zero is a zero-knowledge verifiable general computing platform based on zk-STARKs and the RISC-V microarchitecture. In versions 2.0.2 and below of risc0-zkvm-platform, when the zkVM guest calls sys_read, the host is able to use a crafted response to write to an arbitrary memory location in the guest. This capability can be leveraged to execute arbitrary code within the guest. As sys_read is the mechanism by which input is requested by the guest, all guest programs built with the affected versions are vulnerable. This critically compromises the soundness guarantees of the guest program. Other affected packages include risc0-aggregation versions below 0.9, risc0-zkos-v1compat below 2.1.0, risc0-zkvm versions between 3.0.0-rc.1 and 3.0.1. This issue has been fixed in the following versions: risc0-zkvm-platform 2.1.0, risc0-zkos-v1compat 2.1.0, risc0-aggregation 0.9, and risc0-zkvm 2.3.2 and 3.0.3.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2025-10-02 18:00 UTC

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7761 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/risc0/risc0/security/advisorie…	x_refsource_CONFIRM
https://github.com/risc0/risc0/pull/3351	x_refsource_MISC
https://github.com/risc0/risc0/commit/3f00e1fa015…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
risc0	risc0	Affected: < 2.1.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-61588",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-02T18:00:36.554327Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-02T18:01:05.528Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "risc0",
          "vendor": "risc0",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.1.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "RISC Zero is a zero-knowledge verifiable general computing platform based on zk-STARKs and the RISC-V microarchitecture. In versions 2.0.2 and below of risc0-zkvm-platform, when the zkVM guest calls sys_read, the host is able to use a crafted response to write to an arbitrary memory location in the guest. This capability can be leveraged to execute arbitrary code within the guest. As sys_read is the mechanism by which input is requested by the guest, all guest programs built with the affected versions are vulnerable. This critically compromises the soundness guarantees of the guest program. Other affected packages include risc0-aggregation versions below 0.9,  risc0-zkos-v1compat below 2.1.0, risc0-zkvm versions between 3.0.0-rc.1 and 3.0.1. This issue has been fixed in the following versions: risc0-zkvm-platform 2.1.0, risc0-zkos-v1compat 2.1.0, risc0-aggregation 0.9, and risc0-zkvm 2.3.2 and 3.0.3."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-10-01T23:30:26.257Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/risc0/risc0/security/advisories/GHSA-jqq4-c7wq-36h7",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/risc0/risc0/security/advisories/GHSA-jqq4-c7wq-36h7"
        },
        {
          "name": "https://github.com/risc0/risc0/pull/3351",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/risc0/risc0/pull/3351"
        },
        {
          "name": "https://github.com/risc0/risc0/commit/3f00e1fa0159599c1601e788021f2169d1f0a4dc",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/risc0/risc0/commit/3f00e1fa0159599c1601e788021f2169d1f0a4dc"
        }
      ],
      "source": {
        "advisory": "GHSA-jqq4-c7wq-36h7",
        "discovery": "UNKNOWN"
      },
      "title": "risc0 vulnerable to arbitrary code execution in guest via memory safety failure in `sys_read`"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2025-61588",
    "datePublished": "2025-10-01T23:30:26.257Z",
    "dateReserved": "2025-09-26T16:25:25.150Z",
    "dateUpdated": "2025-10-02T18:01:05.528Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2025-61588",
      "date": "2026-10-23",
      "epss": "0.00463",
      "percentile": "0.39176"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "risc0",
                "vendor": "risc0",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 2.1.0"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "RISC Zero is a zero-knowledge verifiable general computing platform based on zk-STARKs and the RISC-V microarchitecture. In versions 2.0.2 and below of risc0-zkvm-platform, when the zkVM guest calls sys_read, the host is able to use a crafted response to write to an arbitrary memory location in the guest. This capability can be leveraged to execute arbitrary code within the guest. As sys_read is the mechanism by which input is requested by the guest, all guest programs built with the affected versions are vulnerable. This critically compromises the soundness guarantees of the guest program. Other affected packages include risc0-aggregation versions below 0.9,  risc0-zkos-v1compat below 2.1.0, risc0-zkvm versions between 3.0.0-rc.1 and 3.0.1. This issue has been fixed in the following versions: risc0-zkvm-platform 2.1.0, risc0-zkos-v1compat 2.1.0, risc0-aggregation 0.9, and risc0-zkvm 2.3.2 and 3.0.3."
          },
          {
            "lang": "es",
            "value": "RISC Zero es una plataforma de computaci\u00f3n general verificable de conocimiento cero basada en zk-STARKs y la microarquitectura RISC-V. En las versiones 2.0.2 e inferiores de risc0-zkvm-platform, cuando el invitado zkVM llama a sys_read, el anfitri\u00f3n puede usar una respuesta manipulada para escribir en una ubicaci\u00f3n de memoria arbitraria en el invitado. Esta capacidad puede ser aprovechada para ejecutar c\u00f3digo arbitrario dentro del invitado. Dado que sys_read es el mecanismo por el cual el invitado solicita la entrada, todos los programas de invitado construidos con las versiones afectadas son vulnerables. Esto compromete cr\u00edticamente las garant\u00edas de solidez del programa de invitado. Otros paquetes afectados incluyen risc0-aggregation versiones inferiores a 0.9, risc0-zkos-v1compat inferiores a 2.1.0, risc0-zkvm versiones entre 3.0.0-rc.1 y 3.0.1. Este problema ha sido solucionado en las siguientes versiones: risc0-zkvm-platform 2.1.0, risc0-zkos-v1compat 2.1.0, risc0-aggregation 0.9, y risc0-zkvm 2.3.2 y 3.0.3."
          }
        ],
        "id": "CVE-2025-61588",
        "lastModified": "2026-10-19T17:10:00.173",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 9.3,
                "baseSeverity": "CRITICAL",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2025-61588",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-02T18:00:36.554327Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2025-10-02T00:15:49.890",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/risc0/risc0/commit/3f00e1fa0159599c1601e788021f2169d1f0a4dc"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/risc0/risc0/pull/3351"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/risc0/risc0/security/advisories/GHSA-jqq4-c7wq-36h7"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-94"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-10-06T17:13:23+00:00",
      "cve": "CVE-2025-61588",
      "id": "CVE-2025-61588",
      "initial_release_date": "2025-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "risc0 vulnerable to arbitrary code execution in guest via memory safety failure in `sys_read`",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61588.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2025-61588",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "total"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2025-10-02T18:00:36.554327Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2025-10-02T18:00:58.619Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "risc0",
              "vendor": "risc0",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 2.1.0"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "RISC Zero is a zero-knowledge verifiable general computing platform based on zk-STARKs and the RISC-V microarchitecture. In versions 2.0.2 and below of risc0-zkvm-platform, when the zkVM guest calls sys_read, the host is able to use a crafted response to write to an arbitrary memory location in the guest. This capability can be leveraged to execute arbitrary code within the guest. As sys_read is the mechanism by which input is requested by the guest, all guest programs built with the affected versions are vulnerable. This critically compromises the soundness guarantees of the guest program. Other affected packages include risc0-aggregation versions below 0.9,  risc0-zkos-v1compat below 2.1.0, risc0-zkvm versions between 3.0.0-rc.1 and 3.0.1. This issue has been fixed in the following versions: risc0-zkvm-platform 2.1.0, risc0-zkos-v1compat 2.1.0, risc0-aggregation 0.9, and risc0-zkvm 2.3.2 and 3.0.3."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 9.3,
                "baseSeverity": "CRITICAL",
                "privilegesRequired": "NONE",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "HIGH",
                "vulnConfidentialityImpact": "HIGH",
                "vulnIntegrityImpact": "HIGH"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-94",
                  "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2025-10-01T23:30:26.257Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/risc0/risc0/security/advisories/GHSA-jqq4-c7wq-36h7",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/risc0/risc0/security/advisories/GHSA-jqq4-c7wq-36h7"
            },
            {
              "name": "https://github.com/risc0/risc0/pull/3351",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/risc0/risc0/pull/3351"
            },
            {
              "name": "https://github.com/risc0/risc0/commit/3f00e1fa0159599c1601e788021f2169d1f0a4dc",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/risc0/risc0/commit/3f00e1fa0159599c1601e788021f2169d1f0a4dc"
            }
          ],
          "source": {
            "advisory": "GHSA-jqq4-c7wq-36h7",
            "discovery": "UNKNOWN"
          },
          "title": "risc0 vulnerable to arbitrary code execution in guest via memory safety failure in `sys_read`"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2025-61588",
        "datePublished": "2025-10-01T23:30:26.257Z",
        "dateReserved": "2025-09-26T16:25:25.150Z",
        "dateUpdated": "2025-10-02T18:01:05.528Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2025-61588

Vulnerability from fkie_nvd - Published: 2025-10-02 00:15 - Updated: 2026-10-19 17:10

Severity

9.3 (Critical) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/risc0/risc0/commit/3f00e1fa0159599c1601e788021f2169d1f0a4dc
	security-advisories@github.com	https://github.com/risc0/risc0/pull/3351
	security-advisories@github.com	https://github.com/risc0/risc0/security/advisories/GHSA-jqq4-c7wq-36h7

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "risc0",
          "vendor": "risc0",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.1.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "RISC Zero is a zero-knowledge verifiable general computing platform based on zk-STARKs and the RISC-V microarchitecture. In versions 2.0.2 and below of risc0-zkvm-platform, when the zkVM guest calls sys_read, the host is able to use a crafted response to write to an arbitrary memory location in the guest. This capability can be leveraged to execute arbitrary code within the guest. As sys_read is the mechanism by which input is requested by the guest, all guest programs built with the affected versions are vulnerable. This critically compromises the soundness guarantees of the guest program. Other affected packages include risc0-aggregation versions below 0.9,  risc0-zkos-v1compat below 2.1.0, risc0-zkvm versions between 3.0.0-rc.1 and 3.0.1. This issue has been fixed in the following versions: risc0-zkvm-platform 2.1.0, risc0-zkos-v1compat 2.1.0, risc0-aggregation 0.9, and risc0-zkvm 2.3.2 and 3.0.3."
    },
    {
      "lang": "es",
      "value": "RISC Zero es una plataforma de computaci\u00f3n general verificable de conocimiento cero basada en zk-STARKs y la microarquitectura RISC-V. En las versiones 2.0.2 e inferiores de risc0-zkvm-platform, cuando el invitado zkVM llama a sys_read, el anfitri\u00f3n puede usar una respuesta manipulada para escribir en una ubicaci\u00f3n de memoria arbitraria en el invitado. Esta capacidad puede ser aprovechada para ejecutar c\u00f3digo arbitrario dentro del invitado. Dado que sys_read es el mecanismo por el cual el invitado solicita la entrada, todos los programas de invitado construidos con las versiones afectadas son vulnerables. Esto compromete cr\u00edticamente las garant\u00edas de solidez del programa de invitado. Otros paquetes afectados incluyen risc0-aggregation versiones inferiores a 0.9, risc0-zkos-v1compat inferiores a 2.1.0, risc0-zkvm versiones entre 3.0.0-rc.1 y 3.0.1. Este problema ha sido solucionado en las siguientes versiones: risc0-zkvm-platform 2.1.0, risc0-zkos-v1compat 2.1.0, risc0-aggregation 0.9, y risc0-zkvm 2.3.2 y 3.0.3."
    }
  ],
  "id": "CVE-2025-61588",
  "lastModified": "2026-10-19T17:10:00.173",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 9.3,
          "baseSeverity": "CRITICAL",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "HIGH",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-61588",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2025-10-02T18:00:36.554327Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2025-10-02T00:15:49.890",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/risc0/risc0/commit/3f00e1fa0159599c1601e788021f2169d1f0a4dc"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/risc0/risc0/pull/3351"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/risc0/risc0/security/advisories/GHSA-jqq4-c7wq-36h7"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-JQQ4-C7WQ-36H7

Vulnerability from github – Published: 2025-10-01 21:04 – Updated: 2025-10-02 15:11

Summary

risc0 vulnerable to arbitrary code execution in guest via memory safety failure in `sys_read`

Details

Arbitrary code execution in guest via memory safety failure in `sys_read`

In affected versions of risc0-zkvm-platform, when the zkVM guest calls sys_read, the host is able to use a crafted response to write to an arbitrary memory location in the guest. This capability can be leveraged to execute arbitrary code within the guest. As sys_read is the mechanism by which input is requested by the guest, all guest programs built with the affected versions are vulnerable. This critically compromises the soundness guarantees of the guest program.

A fix was applied in #3351. The vulnerable pointer arithmetic was removed, and replaced with a simplified implementation in the v1compat kernel which uses Rust’s slice functions to guarantee memory safety.

The fix has been released as part of risc0-zkvm versions 2.3.2 and 3.0.3. All prior versions are affected.

Remediation

All developers of zkVM applications should update their guests to use risc0-zkvm versions ^2.3.2 or ^3.0.3.

This upgrade can be accomplished by editing all Cargo.toml files in the following way.

Any references to risc0-zkvm should use version specifiers ”2.3.2” or ”3.0.3”.
Any references to risc0-build should use version specifiers ”2.3.2” or ”3.0.3”, matching risc0-zkvm.
Any references to risc0-zkvm-platform should use version specifier ”2.1.0” or later. Most projects will not have direct references to this crate.

Rebuild your application including the guest. You can run the following command to check that the patch is applied:

# Provide the path to your guest Cargo.toml. Should report risc0-zkvm-platform >=v2.1.0
cargo tree --depth 0 -p risc0-zkvm-platform --manifest-path path/to/methods/guest/Cargo.toml

Any applications that use the image ID of this guest need to be updated with the newly built image ID.

Note that there are no changes to the RISC Zero proof system or circuits. Provers are not required to take any action. Users of the Groth16 smart contract verifier and the RISC Zero Verifier Router are not required to take any action beyond updating their guest programs.

Any applications using the risc0-aggregation crate or the RiscZeroSetVerifier smart contract should update to version >=0.9. This application includes a zkVM guest, which is vulnerable in versions prior to 0.9. Instances of the RiscZeroSetVerifier operated by RISC Zero have been disabled via the estop mechanism outlined in the Verifier Management Design.

Severity

9.3 (Critical)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "risc0-zkvm-platform"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "risc0-zkos-v1compat"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "risc0-aggregation"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "risc0-zkvm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.3.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "risc0-zkvm"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.0.0"
            },
            {
              "fixed": "3.0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-61588"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-94"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-10-01T21:04:59Z",
    "nvd_published_at": "2025-10-02T00:15:49Z",
    "severity": "CRITICAL"
  },
  "details": "# Arbitrary code execution in guest via memory safety failure in `sys_read`\n\nIn affected versions of `risc0-zkvm-platform`, when the zkVM guest calls `sys_read`, the host is able to use a crafted response to write to an arbitrary memory location in the guest. This capability can be leveraged to execute arbitrary code within the guest. As `sys_read` is the mechanism by which input is requested by the guest, all guest programs built with the affected versions are vulnerable. This critically compromises the soundness guarantees of the guest program.\n\nA fix was applied in [\\#3351](https://github.com/risc0/risc0/pull/3351). The vulnerable pointer arithmetic was removed, and replaced with a simplified implementation in the `v1compat` kernel which uses Rust\u2019s slice functions to guarantee memory safety.\n\nThe fix has been released as part of `risc0-zkvm` versions `2.3.2` and `3.0.3`. All prior versions are affected.\n\n## Remediation\n\nAll developers of zkVM applications should update their guests to use `risc0-zkvm` versions `^2.3.2` or `^3.0.3`.\n\nThis upgrade can be accomplished by editing all `Cargo.toml` files in the following way.\n\n* Any references to [`risc0-zkvm`](https://crates.io/crates/risc0-zkvm) should use version specifiers `\u201d2.3.2\u201d` or `\u201d3.0.3\u201d`.  \n* Any references to [`risc0-build`](https://crates.io/crates/risc0-build) should use version specifiers `\u201d2.3.2\u201d` or `\u201d3.0.3\u201d`, matching `risc0-zkvm`.  \n* Any references to [`risc0-zkvm-platform`](https://crates.io/crates/risc0-zkvm-platform) should use version specifier `\u201d2.1.0\u201d` or later. Most projects will not have direct references to this crate.\n\nRebuild your application including the guest. You can run the following command to check that the patch is applied:\n\n```shell\n# Provide the path to your guest Cargo.toml. Should report risc0-zkvm-platform \u003e=v2.1.0\ncargo tree --depth 0 -p risc0-zkvm-platform --manifest-path path/to/methods/guest/Cargo.toml\n```\n\nAny applications that use the image ID of this guest need to be updated with the newly built image ID.\n\nNote that there are no changes to the RISC Zero proof system or circuits. Provers are not required to take any action. Users of the Groth16 smart contract verifier and the [RISC Zero Verifier Router](https://dev.risczero.com/api/blockchain-integration/contracts/verifier#verifier-router) are not required to take any action beyond updating their guest programs.\n\nAny applications using the `risc0-aggregation` crate or the `RiscZeroSetVerifier` smart contract should update to version `\u003e=0.9`. This application includes a zkVM guest, which is vulnerable in versions prior to `0.9`. Instances of the `RiscZeroSetVerifier` operated by RISC Zero have been disabled via the estop mechanism outlined in the [Verifier Management Design](https://github.com/risc0/risc0-ethereum/blob/release-2.0/contracts/version-management-design.md#base-verifier-implementations).",
  "id": "GHSA-jqq4-c7wq-36h7",
  "modified": "2025-10-02T15:11:40Z",
  "published": "2025-10-01T21:04:59Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/risc0/risc0/security/advisories/GHSA-jqq4-c7wq-36h7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61588"
    },
    {
      "type": "WEB",
      "url": "https://github.com/risc0/risc0/pull/3351"
    },
    {
      "type": "WEB",
      "url": "https://github.com/risc0/risc0/commit/3f00e1fa0159599c1601e788021f2169d1f0a4dc"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/risc0/risc0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ],
  "summary": "risc0 vulnerable to arbitrary code execution in guest via memory safety failure in `sys_read`"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2025-61588 (GCVE-0-2025-61588)

FKIE_CVE-2025-61588

GHSA-JQQ4-C7WQ-36H7

Arbitrary code execution in guest via memory safety failure in sys_read

Remediation

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour

Arbitrary code execution in guest via memory safety failure in `sys_read`