CVE-2025-51675: openRISC OR1200 program counter update logic error

CVE-2025-51675 · Severity: high · CVSS 7.5 · Published 2026-08-26

The openRISC OR1200 processor, a popular open-source CPU core used in embedded systems and custom hardware designs, contains a flaw in how it updates the program counter—the internal register that tracks which instruction to execute next. When certain system registers (SPRs) change, the processor fails to properly update the program counter, causing it to stall and preventing normal program execution. This can lead to system failures, incorrect program flow, and denial of service conditions in deployed systems.

Technologies: OpenRISC OR1200. Vendors: OpenRISC.

Quick answers

Is CVE-2025-51675 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2025-51675 being exploited in the wild.
How severe is CVE-2025-51675?
High severity, with a CVSS score of 7.5, published 26 August 2026.
Which products and versions are affected?
OpenRISC OR1200 commit 83ac6b42d73f00daa88a996a1f6738d5a639a105.
Is there a fix for CVE-2025-51675?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-51675 attacked?
It is attacked with local access, in device firmware.
Am I affected by CVE-2025-51675?
Check whether you run OpenRISC OR1200 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a logic error (CWE-1202) in the OR1200 processor's program counter generation module (or1200_genpc.v), where the CPU address output (cpu_adr_o) is not properly updated when the Next Program Counter (NPC) value changes in the Special Purpose Registers. When an SPR update occurs, the processor stalls the program counter at its previous value instead of advancing to the new NPC value, resulting in incorrect program fetching and execution stalls. This is a hardware-level design flaw that affects the processor's control flow logic. The vulnerability requires no external attack vector—it manifests during normal processor operation when SPR updates occur. An attacker or malicious code executing on the system could trigger this condition, causing the processor to enter an undefined state and stall indefinitely, effectively denying service. There is no patch available as this is a hardware design issue in the open-source OR1200 core; fixes would require design changes and re-synthesis of the hardware.

Affected products

  • openRISC OR1200 commit 83ac6b42d73f00daa88a996a1f6738d5a639a105

Timeline

  • 2026-08-26: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.