PT-2026-33841 · Unknown · Openxiangshan Nemu

Published 2026-04-20 · Updated 2026-04-21 · CVE-2026-29648

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions OpenXiangShan NEMU (affected versions not specified)

Description When Smstateen is enabled, clearing mstateen0.ENVCFG fails to correctly restrict access to henvcfg and senvcfg. This allows less-privileged code to read or write these Control and Status Registers (CSRs) without triggering the required exception, which may lead to the bypass of state-enable based isolation controls in multi-privilege or virtualized environments.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2026-29648

Affected Products

Openxiangshan Nemu

References · 6

• 🔥 https://github.com/OpenXiangShan/NEMU/issues/690 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-29648 · Security Note
• https://github.com/OpenXiangShan/XiangShan/pull/3978 · Note
• https://twitter.com/infoflowcloud/status/2046603402818273293 · Twitter Post
• https://twitter.com/CVEnew/status/2046601520158761039 · Twitter Post
• https://docs.riscv.org/reference/isa/priv/smstateen.html · Note