What is the CVSS score of CVE-2026-29643?

CVE-2026-29643 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of XiangShan RISC-V Processor are affected by CVE-2026-29643?

CVE-2026-29643 affects XiangShan, an open-source RISC-V processor design, enabling authenticated local attackers to cause denial of service by disrupting processor control flow through malformed…

How to fix or mitigate CVE-2026-29643?

Within 24 hours: Inventory any development systems or CI/CD pipelines using XiangShan commits from November 2024 onward and assess user access controls. Within 7 days: Restrict non-essential user access to affected XiangShan environments pending remediation. Within 30 days: Update to XiangShan commits incorporating the fix from pull request #3966 or later, or apply the proposed NewCSR subsystem exception handling corrections documented in GitHub issue #3959.

XiangShan RISC-V Processor CVE-2026-29643

EUVD-2026-23957 HIGH

Improper Check or Handling of Exceptional Conditions (CWE-703)

2026-04-20 mitre

Denial Of Service N A

7.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.1 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 21, 2026 - 20:24 vuln.today

CVSS changed

Apr 21, 2026 - 20:22 NVD

7.1 (HIGH)

EUVD ID Assigned

Apr 20, 2026 - 21:45 euvd

EUVD-2026-23957

Analysis Generated

Apr 20, 2026 - 21:45 vuln.today

CVE Published

Apr 20, 2026 - 00:00 nvd

HIGH 7.1

DescriptionCVE.org

XiangShan (Open-source high-performance RISC-V processor) commit edb1dfaf7d290ae99724594507dc46c2c2125384 (2024-11-28) contains an improper exceptional-condition handling flaw in its CSR subsystem (NewCSR). On affected versions, certain sequences of CSR operations targeting non-existent/custom CSR addresses may trigger an illegal-instruction exception but fail to reliably transfer control to the configured trap handler (mtvec), causing control-flow disruption and potentially leaving the core in a hung or unrecoverable state. This can be exploited by a local attacker able to execute code on the processor to cause a denial of service and potentially inconsistent architectural state.

AnalysisAI

Control-flow disruption in XiangShan open-source RISC-V processor allows local authenticated attackers to trigger denial of service through malformed CSR operations that fail to properly invoke trap handlers. Affected commits from November 2024 contain improper exception handling in the NewCSR subsystem that can leave the processor core in a hung state when targeting non-existent CSR addresses. GitHub issue #3959 and pull request #3966 document the flaw and proposed fix. EPSS score of 0.02% (5th percentile) indicates very low predicted exploitation probability. No public exploit code identified and not listed in CISA KEV, suggesting primarily theoretical risk limited to specialized RISC-V development environments.

Technical ContextAI

XiangShan is an open-source, out-of-order RISC-V processor implementation targeting high-performance computing. The vulnerability resides in the Control and Status Register (CSR) subsystem, specifically the NewCSR implementation introduced in recent commits. CSRs are privileged registers in RISC-V architecture used for configuration, performance monitoring, and exception handling. Per RISC-V privileged specification, accessing undefined CSR addresses should trigger an illegal-instruction exception and transfer control to the machine-mode trap vector (mtvec). CWE-703 (Improper Check or Handling of Exceptional Conditions) indicates the core fails to properly validate CSR addresses or correctly invoke exception handlers when encountering invalid CSR operations. This represents a fundamental violation of the RISC-V architectural contract where exception handling must be deterministic and reliable. The flaw affects the architectural state machine governing privilege-level transitions, potentially causing the processor to enter undefined states outside normal execution or exception-handling modes.

RemediationAI

Apply the fix provided in GitHub pull request #3966 available at https://github.com/OpenXiangShan/XiangShan/pull/3966, which addresses the CSR exception handling logic in the NewCSR subsystem. For organizations using XiangShan RTL in FPGA prototypes or ASIC designs, verify that your RTL snapshot post-dates the merge of PR #3966 or manually cherry-pick the fix into your design branch. Re-synthesize and re-verify affected implementations through regression testing with CSR access patterns targeting undefined addresses per RISC-V privileged specification test suites. If immediate patching is not feasible, implement compensating controls by restricting execution of untrusted code on XiangShan cores, enforcing strict privilege separation to prevent unprivileged software from executing arbitrary CSR instructions (this requires trusted bootloader and operating system kernel, limiting practical protection), or deploying hardware-level sandboxing through RISC-V PMP (Physical Memory Protection) to isolate untrusted workloads. Note that architectural workarounds cannot fully mitigate the core state corruption risk and re-synthesis with patched RTL remains the only complete remediation.