{"action":"Upgrade risc0-zkvm to 2.3.2 or later.","affected":[{"fixed":"2.3.2","introduced":"0"},{"fixed":"3.0.3","introduced":"3.0.0"}],"component":"risc0-zkvm","cve_ids":["CVE-2025-61588"],"ecosystem":"crates.io","epss":0.00463,"exploited":false,"fixed_versions":["2.3.2","3.0.3"],"ghsa_id":"GHSA-jqq4-c7wq-36h7","id":"tcs_01M5KF178AFNM2ZPJ269PQAYWS","modified_at":"2026-09-10T03:50:29.875858037Z","published_at":"2025-10-01T21:04:59Z","references":["https://osv.dev/vulnerability/GHSA-jqq4-c7wq-36h7","https://github.com/risc0/risc0/security/advisories/GHSA-jqq4-c7wq-36h7","https://nvd.nist.gov/vuln/detail/CVE-2025-61588","https://github.com/risc0/risc0/pull/3351","https://github.com/risc0/risc0/commit/3f00e1fa0159599c1601e788021f2169d1f0a4dc","https://github.com/risc0/risc0"],"severity":{"label":"critical"},"sources":[{"source":"osv","source_id":"GHSA-jqq4-c7wq-36h7#crates.io/risc0-zkvm","url":"https://osv.dev/vulnerability/GHSA-jqq4-c7wq-36h7"}],"summary":"risc0 vulnerable to arbitrary code execution in guest via memory safety failure in `sys_read`"}