crates.io/risc0-aggregation CVE-2025-61588: critical 9.3, EPSS 0.46%
risc0 vulnerable to arbitrary code execution in guest via memory safety failure in `sys_read`
Action: Upgrade risc0-aggregation to 0.9 or later.
cargo update -p risc0-aggregation --precise 0.9Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.9 | - |
Fixed versions
| 0.9 |
Sources
- osv: GHSA-jqq4-c7wq-36h7#crates.io/risc0-aggregation
- nvd: CVE-2025-61588
- https://github.com/risc0/risc0/security/advisories/GHSA-jqq4-c7wq-36h7
- https://github.com/risc0/risc0/pull/3351
- https://github.com/risc0/risc0/commit/3f00e1fa0159599c1601e788021f2169d1f0a4dc
- https://github.com/risc0/risc0
CVE-2025-61588 · published · modified · JSON