CVE-2025-46723CWE-131

OpenVM byte decomposition of pc in AUIPC chip can overflow

High · published May 2, 2025

CVSS v4.0
7.8
EPSS
0%
Percentile
40.1
In the wild
Unconfirmed
What it is

OpenVM is a performant and modular zkVM framework built for customization and extensibility. In version 1.0.0, OpenVM is vulnerable to overflow through byte decomposition of pc in AUIPC chip. A typo results in the highest limb of pc being range checked to 8-bits instead of 6-bits. This results in the if statement never being triggered because the enumeration gives i=0,1,2, when instead the enumeration should give i=1,2,3, leaving pc_limbs[3] range checked to 8-bits instead of 6-bits. This leads to a vulnerability where the pc_limbs decomposition differs from the true pc, which means a malicious prover can make the destination register take a different value than the AUIPC instruction dictates, by making the decomposition overflow the BabyBear field. This issue has been patched in version 1.1.0.

The record
Technical detail
CVSS v4.0
7.8 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
EPSS
0.00475 · 40.1th percentile
Weakness
CWE-131 · Incorrect Calculation of Buffer Size
Published
2025-05-02T22:18Z
EPSS history
Timeline
  • 02 MAY 22:18Z
    OpenVM byte decomposition of pc in AUIPC chip can overflow
    cvelistv5