What is the CVSS score of CVE-2026-29642?

CVE-2026-29642 has a CVSS 3.1 base score of 7.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of XiangShan are affected by CVE-2026-29642?

CVE-2026-29642 affects XiangShan RISC-V processor cores, allowing local M-mode attackers to corrupt critical processor status registers through malformed CSR instructions.

How to fix or mitigate CVE-2026-29642?

Within 24 hours: Identify all systems using XiangShan RISC-V processor cores and document current firmware/design commit versions. Within 7 days: Restrict M-mode access to trusted administrators only and review hardware security module configurations; contact XiangShan project maintainers for confirmed release version containing commit 5e3dd63. Within 30 days: Deploy updated XiangShan processor core or firmware version once vendor release is confirmed, and conduct post-deployment validation of CSR register integrity.

XiangShan CVE-2026-29642

EUVD-2026-23954 HIGH

Internal Asset Exposed to Unsafe Debug Access Level or State (CWE-1244)

2026-04-20 mitre

GHSA-9m35-v5wh-m3xw

Information Disclosure N A

7.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 21, 2026 - 20:23 vuln.today

CVSS changed

Apr 21, 2026 - 20:22 NVD

7.8 (HIGH)

EUVD ID Assigned

Apr 20, 2026 - 21:15 euvd

EUVD-2026-23954

Analysis Generated

Apr 20, 2026 - 21:15 vuln.today

CVE Published

Apr 20, 2026 - 00:00 nvd

HIGH 7.8

DescriptionCVE.org

A local attacker who can execute privileged CSR operations (or can induce firmware to do so) performs carefully crafted reads/writes to menvcfg (e.g., csrrs in M-mode). On affected XiangShan versions (commit aecf601e803bfd2371667a3fb60bfcd83c333027, 2024-11-19), these menvcfg accesses can unexpectedly set WPRI (reserved) bits in the status view (xstatus) to 1. RISC-V defines WPRI fields as "writes preserve values, reads ignore values," i.e., they must not be modified by software manipulating other fields, and menvcfg itself contains multiple WPRI fields.

AnalysisAI

Privileged CSR manipulation in XiangShan RISC-V processor core (commit aecf601e80, 2024-11-19) allows local attackers with M-mode access to corrupt processor status registers by exploiting improper handling of WPRI (Write Preserve, Read Ignore) fields in menvcfg operations. Carefully crafted csrrs instructions targeting menvcfg unexpectedly set reserved bits in xstatus to 1, violating RISC-V specification requirements that WPRI fields remain unchanged during CSR operations. Upstream fix committed (5e3dd63) but released version not confirmed. EPSS score 5th percentile indicates low real-world exploitation probability despite theoretical high impact, with no active exploitation or public POC identified.

Technical ContextAI

XiangShan is an open-source out-of-order RISC-V processor core developed by the Institute of Computing Technology, Chinese Academy of Sciences. This vulnerability affects the Control and Status Register (CSR) subsystem, specifically the Machine Environment Configuration register (menvcfg) implementation. RISC-V privileged specification defines WPRI (Write Preserve, Read Ignore) fields as reserved bit ranges that must maintain their values across CSR operations - software modifying other fields should not alter WPRI bits, and reads should return predictable values. The menvcfg register, introduced in RISC-V privileged spec version 1.12 for configuring machine-mode environment features, contains multiple WPRI fields. The vulnerability maps to CWE-1244 (Internal Asset Exposed to Unsafe Debug Access Level), indicating improper isolation between debug/privileged operations and architectural state. The affected commit (aecf601e803bfd2371667a3fb60bfcd83c333027) from November 2024 suggests the flaw was introduced during recent menvcfg implementation or refactoring work in the XiangShan core's CSR handling logic.

RemediationAI

Update XiangShan processor core to commit 5e3dd63 or later from the upstream repository (https://github.com/OpenXiangShan/XiangShan/commit/5e3dd63), which addresses the menvcfg WPRI field handling flaw. Hardware vendors integrating XiangShan must resynththesize RTL, reverify the design, and redistribute updated FPGA bitstreams or tape out corrected silicon - note that silicon fixes require full chip respins with 6-12 month lead times and may not be economically feasible for low-volume products. For deployed systems running vulnerable XiangShan cores where hardware updates are impractical, implement firmware-level mitigations: minimize or eliminate dynamic menvcfg modifications in M-mode code (bootloaders, secure monitors, hypervisors), validate xstatus register contents after any menvcfg operations with explicit bit-masking to clear reserved fields, and restrict M-mode code execution to vendor-signed firmware only via secure boot mechanisms. These compensating controls reduce attack surface but cannot eliminate the hardware-level flaw. RISC-V specification references for validation: machine-mode CSR documentation at https://docs.riscv.org/reference/isa/priv/machine.html and WPRI field semantics at https://docs.riscv.org/reference/isa/priv/priv-csrs.html. Note that firmware workarounds add runtime overhead to CSR operations and may impact real-time performance in embedded applications.