PT-2026-33826 · Openxiangshan · Nemu

Published 2026-04-20 · Updated 2026-04-21 · CVE-2026-29645

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions NEMU (OpenXiangShan/NEMU) versions prior to v2025.12.r2

Description An improper instruction-validation flaw exists in the RISC-V Vector (RVV) decoder. The decoder fails to correctly validate the funct3 field when decoding 'vsetvli', 'vsetivli', and 'vsetvl' instructions. This allows certain invalid OP-V instruction encodings to be misinterpreted and executed as vset* configuration instructions instead of triggering an illegal-instruction exception. This can be exploited using crafted RISC-V binaries to cause incorrect trap behavior, architectural state corruption or divergence, and potential denial of service in systems relying on the software for correct execution or sandboxing.

Recommendations Update to version v2025.12.r2.

Fix

Weakness Enumeration

CWE-131

CWE-1287

Related Identifiers

CVE-2026-29645

Affected Products

Nemu

References · 8

• https://github.com/OpenXiangShan/NEMU/commit/481de637d5fc5838356caee80a79e56a33754039 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-29645 · Security Note
• https://github.com/OpenXiangShan/NEMU/issues/952 · Note
• https://github.com/OpenXiangShan/NEMU/pull/958 · Note
• https://twitter.com/vuldb/status/2046573974054982098 · Twitter Post
• https://twitter.com/infoflowcloud/status/2046603308576489840 · Twitter Post
• https://twitter.com/CVEnew/status/2046601517394792510 · Twitter Post
• https://docs.riscv.org/reference/isa/unpriv/v-st-ext.html · Note