crates.io/risc0-zkvm CVE-2025-61588: critical, EPSS 0.46%
risc0 vulnerable to arbitrary code execution in guest via memory safety failure in `sys_read`
Action: Upgrade risc0-zkvm to 2.3.2 or later.
cargo update -p risc0-zkvm --precise 2.3.2cargo update -p risc0-zkvm --precise 3.0.3Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 2.3.2 | - |
| 3.0.0 | 3.0.3 | - |
Fixed versions
| 2.3.2 | 3.0.3 |
Sources
- osv: GHSA-jqq4-c7wq-36h7#crates.io/risc0-zkvm
- https://github.com/risc0/risc0/security/advisories/GHSA-jqq4-c7wq-36h7
- https://nvd.nist.gov/vuln/detail/CVE-2025-61588
- https://github.com/risc0/risc0/pull/3351
- https://github.com/risc0/risc0/commit/3f00e1fa0159599c1601e788021f2169d1f0a4dc
- https://github.com/risc0/risc0
CVE-2025-61588 · published · modified · JSON