Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploitation needs local execution of a crafted instruction on the core (AV:L, PR:L); the mismatch causes only a hang/crash, so A:H with no confidentiality or integrity impact.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
4DescriptionCVE.org
An issue was discovered in RISC-V PicoRV32 commit 87c89a. A mismatch in the PCPI INSN and memory address can lead to unexpected behavior.
AnalysisAI
Denial-of-service in the YosysHQ PicoRV32 RISC-V soft CPU core (commit 87c89a) arises from a mismatch between a PCPI (Pico Co-Processor Interface) instruction and the associated memory address, causing unexpected core behavior classified as a memory-bounds (buffer overflow, CWE-119) fault. The affected party is anyone synthesizing this open-source core into an FPGA/ASIC design; a crafted instruction stream can drive the core into an inconsistent state impacting availability. The flaw was surfaced through academic hardware-fuzzing research (SynFuzz), with no public exploit identified and a low EPSS score of 0.17% (6th percentile).
Technical ContextAI
PicoRV32 is a small, size-optimized RISC-V (RV32IMC) CPU core maintained by YosysHQ, commonly used as an auxiliary/soft core in FPGA and ASIC designs and as a teaching/research target. The PCPI (Pico Co-Processor Interface) is PicoRV32's mechanism for offloading instructions (e.g., multiply/divide or custom co-processor ops) to external logic. The reported defect is a mismatch between the PCPI instruction being dispatched and the memory address state, which under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) manifests as out-of-bounds or inconsistent memory/register behavior in the core's execution pipeline. Because this is a hardware IP core rather than a running network service, the 'attack' is the execution of a specific instruction sequence on the core itself.
Affected ProductsAI
YosysHQ PicoRV32 RISC-V soft CPU core at commit 87c89a is the affected component, per the MITRE-issued CVE and the linked GitHub issue https://github.com/YosysHQ/picorv32/issues/269. No CPE strings were provided in the intelligence set, and affected version ranges are expressed only as a source commit rather than a tagged release, so downstream designs that synthesized PicoRV32 around that commit should be considered potentially affected. Supporting research context is documented at https://mason.gmu.edu/~rsaravan/projects/synfuzz/cve/cve.html and in the arXiv paper https://www.arxiv.org/abs/2504.18812.
RemediationAI
No vendor-released patch identified at time of analysis; the only upstream reference is the open tracking issue at https://github.com/YosysHQ/picorv32/issues/269, so treat any fix as not yet independently confirmed and monitor that issue and the YosysHQ/picorv32 repository for a corrected commit or tagged release. As compensating controls for integrators: if the PCPI co-processor interface is not required, disable it by leaving ENABLE_PCPI/ENABLE_MUL/ENABLE_DIV parameters off at synthesis so the affected instruction path is not present (trade-off: loses hardware mul/div and any custom co-processor acceleration); restrict which instruction streams can run on the core (trusted/attested firmware only), since exploitation depends on executing a crafted instruction sequence; and in safety-relevant designs add a watchdog/reset around the core to bound the availability impact of a hang (trade-off: recovery latency, not prevention). Re-validate any local RTL changes against the SynFuzz methodology referenced above.
Same weakness CWE-119 – Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today