What is the CVSS score of CVE-2025-51675?

CVE-2025-51675 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of openRISC OR1200 are affected by CVE-2025-51675?

The openRISC OR1200 soft-core processor contains a denial-of-service vulnerability (CVE-2025-51675, CVSS 7.5) that could render hardware designs using this processor unavailable through improper…

How to fix or mitigate CVE-2025-51675?

Within 24 hours: identify any organizational use of openRISC OR1200 in current FPGA designs or embedded systems, and assess the criticality of affected hardware. Within 7 days: contact hardware and FPGA vendors to determine if alternative processor designs without this vulnerability are available for migration. Within 30 days: for systems that cannot be replaced, work with vendors to implement hardware-level mitigations such as watchdog timers to detect processor state anomalies, and establish enhanced monitoring and alerting for abnormal processor behavior.

openRISC OR1200 CVE-2025-51675

EUVD-2025-210799 HIGH

Insufficient Control Flow Management (CWE-691)

2026-08-26 mitre

GHSA-f96g-rjqw-vv44

Denial Of Service N A

7.5

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

4.4 MEDIUM

Triggering the SPR-to-PC flaw requires privileged code execution on the OR1200 core; AV:L and PR:H better reflect this than the NVD-assigned AV:N/PR:N.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 27, 2026 - 22:50 vuln.today

CVSS changed

Aug 27, 2026 - 20:37 NVD

7.5 (HIGH)

CVE Published

Aug 26, 2026 - 00:00 cve.org

HIGH 7.5

CVE Published

Aug 26, 2026 - 00:00 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

An issue was discovered in openRISC OR1200 commit 83ac6b. An inaccurate update of program counter (PC) values when SPR changes can lead to a Denial of Service (DoS).

AnalysisAI

Denial of service in the openRISC OR1200 soft-core processor (commit 83ac6b) stems from inaccurate program counter updates when Special Purpose Registers are modified, causing the processor to enter an invalid execution state. The flaw, classified under CWE-691 (Insufficient Control Flow Management), was discovered through hardware synthesis fuzzing (SynFuzz) at George Mason University. No public exploit code or active exploitation has been identified, and EPSS places the exploitation probability at 0.14% (4th percentile), consistent with a niche research-grade hardware target.

Technical ContextAI

OR1200 is an open-source, synthesizable 32-bit RISC soft-core processor implementing the OpenRISC 1000 architecture, commonly instantiated in FPGAs and SoCs for academic and embedded research purposes. Special Purpose Registers (SPRs) in the OpenRISC architecture control supervisor-mode behavior, including exception handling and pipeline control. CWE-691 (Insufficient Control Flow Management) identifies the root cause: the RTL logic that synchronizes the Program Counter with SPR state transitions contains an inaccuracy, allowing the PC to diverge from expected values during or after SPR writes. The specific commit implicated is 83ac6b of the openRISC OR1200 repository. The CPE provided (cpe:2.3:a:n/a:n/a:*:*:*:*:*:*:*:*) is a placeholder and offers no additional product scoping. The referenced GMU SynFuzz page indicates discovery via automated RTL-level fuzzing, a technique targeting hardware description language implementations rather than compiled software.

RemediationAI

No vendor-released patch or fixed commit is identified in the available data. Affected parties should consult the openRISC OR1200 upstream repository for a corrective RTL patch addressing the SPR-to-PC synchronization logic. As a compensating control, FPGA and SoC integrators can restrict write access to SPRs at the system integration level by limiting supervisor-mode code paths that modify SPRs to vetted, trusted firmware only, reducing the exposure surface without removing SPR functionality. Restricting untrusted code execution on OR1200 instances - for example, by enforcing memory protection and supervisor/user mode separation - would prevent an unprivileged actor from issuing the SPR writes that trigger the fault. The trade-off is reduced runtime flexibility for embedded applications that rely on dynamic SPR configuration. Monitor the upstream openRISC OR1200 repository for a patched commit and re-synthesize any deployed bitstreams after applying the fix.