NEMU (OpenXiangShan/NEMU) before v2025.12.r2 contains an improper instruction-validation flaw in its RISC-V Vector (RVV) decoder. The decoder does not correctly validate the funct3 field when decoding vsetvli/vsetivli/vsetvl, allowing certain invalid OP-V instruction encodings to be misinterpreted and executed as vset* configuration instructions rather than raising an illegal-instruction exception. This can be exploited by providing crafted RISC-V binaries to cause incorrect trap behavior, architectural state corruption/divergence, and potential denial of service in systems that rely on NEMU for correct execution or sandboxing.
References
| Link | Resource |
|---|---|
| https://docs.riscv.org/reference/isa/unpriv/v-st-ext.html | Product |
| https://github.com/OpenXiangShan/NEMU/commit/481de637d5fc5838356caee80a79e56a33754039 | Patch |
| https://github.com/OpenXiangShan/NEMU/issues/952 | Issue Tracking |
| https://github.com/OpenXiangShan/NEMU/pull/958 | Issue Tracking |
Configurations
History
24 Apr 2026, 19:25
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:xiangshan:nemu:2025.12:r1:*:*:*:*:*:* | |
| First Time |
Xiangshan nemu
Xiangshan |
|
| References | () https://docs.riscv.org/reference/isa/unpriv/v-st-ext.html - Product | |
| References | () https://github.com/OpenXiangShan/NEMU/commit/481de637d5fc5838356caee80a79e56a33754039 - Patch | |
| References | () https://github.com/OpenXiangShan/NEMU/issues/952 - Issue Tracking | |
| References | () https://github.com/OpenXiangShan/NEMU/pull/958 - Issue Tracking |
21 Apr 2026, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-1287 CWE-131 |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
20 Apr 2026, 20:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-20 20:16
Updated : 2026-04-24 19:25
NVD link : CVE-2026-29645
Mitre link : CVE-2026-29645
CVE.ORG link : CVE-2026-29645
JSON object : View
Products Affected
xiangshan
- nemu