CVE-2025-52484: zkVM Underconstrained Vulnerability

Due to a missing constraint in the rv32im circuit, any 3-register RISC-V instruction (including remu and divu) in risc0-zkvm 2.0.0, 2.0.1, and 2.0.2 are vulnerable to an attack by a malicious prover. The main idea for the attack is to confuse the RISC-V virtual machine into treating the value of the rs1 register as the same as the rs2 register due to a lack of constraints in the rv32im circuit.

This vulnerability was reported by Christoph Hochrainer via our Hackenproof bug bounty. We have evaluated the severity of the vulnerability as “Critical,” and paid a bounty.