Skip to content
OpenAdvisories
High · 7.8 CVE-2025-46723 EUVD-2025-13439GHSA-jf2r-x3j4-23m7

OpenVM byte decomposition of pc in AUIPC chip can overflow

Published May 2, 2025 · Updated May 6, 2025 · Assigned by GitHub_M

Description

OpenVM is a performant and modular zkVM framework built for customization and extensibility. In version 1.0.0, OpenVM is vulnerable to overflow through byte decomposition of pc in AUIPC chip. A typo results in the highest limb of pc being range checked to 8-bits instead of 6-bits. This results in the if statement never being triggered because the enumeration gives i=0,1,2, when instead the enumeration should give i=1,2,3, leaving pc_limbs[3] range checked to 8-bits instead of 6-bits. This leads to a vulnerability where the pc_limbs decomposition differs from the true pc, which means a malicious prover can make the destination register take a different value than the AUIPC instruction dictates, by making the decomposition overflow the BabyBear field. This issue has been patched in version 1.1.0.

Affected products

VendorProductAffectedFixed
openvm-org openvm = 1.0.0 —

Affected packages

EcosystemPackageAffectedFixedRecord
crates.io openvm >= 1.0.0, < 1.1.0 1.1.0 GHSA-jf2r-x3j4-23m7

References