risc0 vulnerable to arbitrary code execution in guest via memory safety failure in `sys_read`

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2025-61588 · Microsoft / collected KEV context

EUVD-2025-32663

GHSA-jqq4-c7wq-36h7

cve-program · CVE-2025-61588

• https://github.com/risc0/risc0/security/advisories/GHSA-jqq4-c7wq-36h7
• https://github.com/risc0/risc0/pull/3351
• https://github.com/risc0/risc0/commit/3f00e1fa0159599c1601e788021f2169d1f0a4dc

euvd · EUVD-2025-32663

• https://github.com/risc0/risc0/security/advisories/GHSA-jqq4-c7wq-36h7
• https://github.com/risc0/risc0/pull/3351
• https://github.com/risc0/risc0/commit/3f00e1fa0159599c1601e788021f2169d1f0a4dc

nvd · CVE-2025-61588

• https://github.com/risc0/risc0/commit/3f00e1fa0159599c1601e788021f2169d1f0a4dc
• https://github.com/risc0/risc0/pull/3351
• https://github.com/risc0/risc0/security/advisories/GHSA-jqq4-c7wq-36h7

osv · GHSA-jqq4-c7wq-36h7

• https://github.com/risc0/risc0/security/advisories/GHSA-jqq4-c7wq-36h7
• https://nvd.nist.gov/vuln/detail/CVE-2025-61588
• https://github.com/risc0/risc0/pull/3351
• https://github.com/risc0/risc0/commit/3f00e1fa0159599c1601e788021f2169d1f0a4dc
• https://github.com/risc0/risc0

No related operational record is retained in the current change model.