N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-61588

CVE-2025-61588: risc0 vulnerable to arbitrary code execution in guest via memory safety failure in `sys_read`

Arbitrary code execution in guest via memory safety failure in `sys_read`

In affected versions of risc0-zkvm-platform, when the zkVM guest calls sys_read, the host is able to use a crafted response to write to an arbitrary memory location in the guest. This capability can be leveraged to execute arbitrary code within the guest. As sys_read is the mechanism by which input is requested by the guest, all guest programs built with the affected versions are vulnerable. This critically compromises the soundness guarantees of the guest program.

A fix was applied in #3351. The vulnerable pointer arithmetic was removed, and replaced with a simplified implementation in the v1compat kernel which uses Rust’s slice functions to guarantee memory safety.

The fix has been released as part of risc0-zkvm versions 2.3.2 and 3.0.3. All prior versions are affected.

Remediation

All developers of zkVM applications should update their guests to use risc0-zkvm versions ^2.3.2 or ^3.0.3.

This upgrade can be accomplished by editing all Cargo.toml files in the following way.

Any references to risc0-zkvm should use version specifiers ”2.3.2” or ”3.0.3”.
Any references to risc0-build should use version specifiers ”2.3.2” or ”3.0.3”, matching risc0-zkvm.
Any references to risc0-zkvm-platform should use version specifier ”2.1.0” or later. Most projects will not have direct references to this crate.

Rebuild your application including the guest. You can run the following command to check that the patch is applied:

Miggo Vulnerability Database

→

CVE-2025-61588

CVE-2025-61588:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
risc0-zkvm-platform	rust	< 2.1.0	2.1.0
risc0-zkos-v1compat	rust	< 2.1.0	2.1.0
risc0-aggregation

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the sys_read implementation used by the RISC Zero zkVM guest. When a guest program requests to read data from the host, the underlying functions responsible for handling this I/O operation contained a critical memory safety flaw. The root cause was that the code trusted the number of bytes reported as 'read' by the host. This value was then used in pointer arithmetic to calculate the memory address for the next write operation.

A malicious host could exploit this by providing a crafted response, claiming to have written a number of bytes larger than the actual buffer allocated by the guest. This would cause the guest to write subsequent data out-of-bounds, leading to a buffer overflow. This overflow could be leveraged to overwrite critical memory, such as return addresses on the stack, to achieve arbitrary code execution within the guest, completely compromising the integrity of the zkVM's computation.

The analysis of the patch identified three key functions involved in this vulnerable process:

risc0_zkvm_platform::syscall::sys_read: The primary entry point for the guest's read operations.
risc0_zkvm_platform::syscall::sys_read_internal: An internal helper that performed the vulnerable chunked reading logic.
risc0_zkos_v1compat::zkvm::ecall_software: A kernel-level function in the v1 compatibility layer that also contained a flawed chunking implementation for large reads.

The fix involved a major refactoring of the I/O subsystem. The vulnerable, manual pointer arithmetic was replaced with safer Rust slice operations. Crucially, checks were added in the new kernel-level sys_read implementation to validate that the number of bytes read from the host does not exceed the size of the guest's buffer, thereby mitigating the buffer overflow vulnerability.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.