Skip to main content

PicoRV32 CVE-2025-51678

HIGH
Buffer Overflow (CWE-119)
2026-07-17 cve@mitre.org
7.5
CVSS 3.1 · Vendor: mitre
Share

Severity by source

Vendor (mitre) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Exploitation needs local execution of a crafted instruction on the core (AV:L, PR:L); the mismatch causes only a hang/crash, so A:H with no confidentiality or integrity impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (mitre).

CVSS VectorVendor: mitre

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 20, 2026 - 19:25 vuln.today
CVSS changed
Jul 20, 2026 - 19:22 NVD
7.5 (HIGH)
CVE Published
Jul 17, 2026 - 20:17 cve.org
HIGH 7.5
CVE Published
Jul 17, 2026 - 20:17 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

An issue was discovered in RISC-V PicoRV32 commit 87c89a. A mismatch in the PCPI INSN and memory address can lead to unexpected behavior.

AnalysisAI

Denial-of-service in the YosysHQ PicoRV32 RISC-V soft CPU core (commit 87c89a) arises from a mismatch between a PCPI (Pico Co-Processor Interface) instruction and the associated memory address, causing unexpected core behavior classified as a memory-bounds (buffer overflow, CWE-119) fault. The affected party is anyone synthesizing this open-source core into an FPGA/ASIC design; a crafted instruction stream can drive the core into an inconsistent state impacting availability. The flaw was surfaced through academic hardware-fuzzing research (SynFuzz), with no public exploit identified and a low EPSS score of 0.17% (6th percentile).

Technical ContextAI

PicoRV32 is a small, size-optimized RISC-V (RV32IMC) CPU core maintained by YosysHQ, commonly used as an auxiliary/soft core in FPGA and ASIC designs and as a teaching/research target. The PCPI (Pico Co-Processor Interface) is PicoRV32's mechanism for offloading instructions (e.g., multiply/divide or custom co-processor ops) to external logic. The reported defect is a mismatch between the PCPI instruction being dispatched and the memory address state, which under CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) manifests as out-of-bounds or inconsistent memory/register behavior in the core's execution pipeline. Because this is a hardware IP core rather than a running network service, the 'attack' is the execution of a specific instruction sequence on the core itself.

Affected ProductsAI

YosysHQ PicoRV32 RISC-V soft CPU core at commit 87c89a is the affected component, per the MITRE-issued CVE and the linked GitHub issue https://github.com/YosysHQ/picorv32/issues/269. No CPE strings were provided in the intelligence set, and affected version ranges are expressed only as a source commit rather than a tagged release, so downstream designs that synthesized PicoRV32 around that commit should be considered potentially affected. Supporting research context is documented at https://mason.gmu.edu/~rsaravan/projects/synfuzz/cve/cve.html and in the arXiv paper https://www.arxiv.org/abs/2504.18812.

RemediationAI

No vendor-released patch identified at time of analysis; the only upstream reference is the open tracking issue at https://github.com/YosysHQ/picorv32/issues/269, so treat any fix as not yet independently confirmed and monitor that issue and the YosysHQ/picorv32 repository for a corrected commit or tagged release. As compensating controls for integrators: if the PCPI co-processor interface is not required, disable it by leaving ENABLE_PCPI/ENABLE_MUL/ENABLE_DIV parameters off at synthesis so the affected instruction path is not present (trade-off: loses hardware mul/div and any custom co-processor acceleration); restrict which instruction streams can run on the core (trusted/attested firmware only), since exploitation depends on executing a crafted instruction sequence; and in safety-relevant designs add a watchdog/reset around the core to bound the availability impact of a hang (trade-off: recovery latency, not prevention). Re-validate any local RTL changes against the SynFuzz methodology referenced above.

Share

CVE-2025-51678 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy