CVE-2025-51678: RISC-V PicoRV32 Buffer Overflow Flaw

CVE-2025-51678 Overview

CVE-2025-51678 affects the RISC-V PicoRV32 soft-core CPU at commit 87c89a. The flaw stems from a mismatch between the Pico Co-Processor Interface (PCPI) instruction and the memory address, leading to unexpected processor behavior. PicoRV32 is a size-optimized RISC-V CPU implementation widely used in FPGA designs, embedded controllers, and open-source hardware projects. The issue is categorized under [CWE-119], improper restriction of operations within the bounds of a memory buffer. An attacker able to supply crafted instruction streams to a vulnerable PicoRV32 implementation can trigger conditions that impact processor availability.

Critical Impact
A network-reachable attacker can cause a high-impact availability failure in RISC-V PicoRV32 systems by exploiting the PCPI instruction and memory address mismatch, with no privileges or user interaction required.

Affected Products

RISC-V PicoRV32 soft-core CPU at commit 87c89a
FPGA and embedded designs incorporating the affected PicoRV32 revision
Downstream projects and forks derived from the vulnerable commit

Discovery Timeline

2026-07-17 - CVE-2025-51678 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2025-51678

Vulnerability Analysis

The vulnerability resides in the interaction between the Pico Co-Processor Interface (PCPI) and the memory subsystem of the PicoRV32 core. PCPI is the mechanism PicoRV32 exposes so external co-processors can implement custom instructions such as multiplication or division extensions. When a PCPI instruction is dispatched, the core coordinates instruction decoding with memory-side operations that reference addresses in the pipeline.

The defect arises because the PCPI instruction path and the memory address path can become inconsistent. This inconsistency causes the core to enter an unexpected state, producing behavior outside the documented instruction semantics. Because PicoRV32 is a hardware description shipped as Verilog, the issue is embedded in synthesized silicon or FPGA bitstreams and cannot be patched at runtime without redeployment.

The weakness falls under [CWE-119] because the mismatch involves memory address handling during instruction execution. Research on the issue is documented in the GitHub Issue Discussion and the ArXiv Research Paper that introduced the Synfuzz methodology.

Root Cause

The root cause is a synchronization defect between the PCPI instruction decoder and the memory address generation logic. When the PCPI-issued instruction does not align with the memory address the core presents on the bus, the pipeline reaches an invalid state. This state was not anticipated in the RTL control flow, so no defensive path exists to recover.

Attack Vector

The vulnerability is exploitable over a network attack surface when the affected PicoRV32 core executes untrusted instruction streams. Systems that decode attacker-influenced code, such as programmable network appliances, softcore-backed accelerators, or bitstream-loaded IoT devices, are within scope. Exploitation requires no authentication and no user interaction, and it produces a high-impact availability outcome without exposing confidentiality or integrity data.

The vulnerability manifests inside the PicoRV32 RTL rather than in software. Because no verified public exploit code exists, technical readers should consult the Project Synfuzz CVE Resource for reproduction details generated by the Synfuzz fuzzing framework.

Detection Methods for CVE-2025-51678

Indicators of Compromise

Unexpected halts, resets, or watchdog-triggered reboots on devices running PicoRV32 cores derived from commit 87c89a.
Anomalous PCPI transactions in RTL-level traces where the co-processor instruction opcode does not correspond to the memory address emitted by the core.
Bitstream or firmware images built from vulnerable PicoRV32 revisions without vendor patch metadata.

Detection Strategies

Audit build manifests and hardware description repositories for the PicoRV32 commit hash 87c89a or derivative forks.
Instrument PCPI signals during hardware-in-the-loop testing to identify instruction and address desynchronization.
Apply differential fuzzing against the RISC-V instruction set, following the methodology described in the ArXiv Research Paper.

Monitoring Recommendations

Track uptime and reset counters for embedded assets that host PicoRV32-based logic and alert on unexplained availability drops.
Log firmware and bitstream provenance so vulnerable revisions can be inventoried and correlated with device telemetry.
Correlate device crash telemetry with recent inbound instruction or workload changes to distinguish exploitation from hardware faults.

How to Mitigate CVE-2025-51678

Immediate Actions Required

Identify every deployed FPGA image, ASIC, or simulator using PicoRV32 at or near commit 87c89a.
Restrict network paths that allow untrusted parties to submit instruction streams to affected cores.
Apply the latest upstream PicoRV32 revision that addresses the PCPI and memory address alignment, and rebuild bitstreams before redeployment.

Patch Information

No formal vendor advisory has been published in the CVE record. Track remediation progress and pull requests through the upstream GitHub Issue Discussion. Rebuild and reflash affected FPGA targets once a corrected commit is merged, since hardware description fixes require resynthesis.

Workarounds

Disable PCPI-based co-processor extensions in the PicoRV32 configuration when custom instructions are not required for the workload.
Constrain the instruction stream by validating or signing firmware before it is loaded onto the PicoRV32 core.
Place vulnerable devices behind network segmentation that blocks untrusted sources from delivering executable payloads.

bash

# Configuration example: disable PCPI in PicoRV32 instantiation to remove the vulnerable path
# Refer to picorv32.v parameters when integrating the core
# ENABLE_PCPI = 0 removes the Pico Co-Processor Interface
# ENABLE_MUL  = 0 and ENABLE_DIV = 0 remove PCPI-dependent extensions
parameter ENABLE_PCPI = 0;
parameter ENABLE_MUL  = 0;
parameter ENABLE_DIV  = 0;