mediumInteger overflow/underflowOther
Brevis Pico ZKVM: Missing `offset` check will cause integer overflow violating ELF specification
- Payout
- $0
- Protocol
- Brevis Pico ZKVM
- Disclosed
- Sep 29, 2025
- Source
- sherlock
The Brevis Pico ZKVM's ELF disassembler, in the `Elf::new()` constructor, computed file offsets for segment loading with an unchecked u32 addition (`offset + i + j`) before casting to usize. Because the addition happens in u32 space, a crafted RISC-V ELF carry …
Similar reports
- No close matches yet.
References
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.