What is the CVSS score of CVE-2026-29645?

CVE-2026-29645 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of NEMU are affected by CVE-2026-29645?

OpenXiangShan NEMU, a RISC-V emulator used in development and validation, contains a denial-of-service flaw in vector instruction decoding triggered by malformed binaries; no public exploit…

How to fix or mitigate CVE-2026-29645?

Within 24 hours, audit current NEMU deployments and versions across the organization, particularly in RISC-V development and simulation pipelines. Within 7 days, schedule and prepare deployment of OpenXiangShan NEMU v2025.12.r2 or later, testing compatibility with existing RISC-V binaries and workflows. Within 30 days, complete deployment of the patched version across all development and CI/CD systems.

NEMU CVE-2026-29645

EUVD-2026-23937 HIGH

Incorrect Calculation of Buffer Size (CWE-131)

2026-04-20 mitre

Denial Of Service N A

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

6.2 MEDIUM

Exploitation requires supplying a crafted binary for local emulation rather than attacking a network service, so AV:L; no confidentiality/integrity loss, availability/state-correctness impact only.

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 07:13 vuln.today

Analysis Generated

Jul 24, 2026 - 07:13 vuln.today

CVSS changed

Apr 21, 2026 - 20:22 NVD

7.5 (HIGH)

EUVD ID Assigned

Apr 20, 2026 - 20:00 euvd

EUVD-2026-23937

CVE Published

Apr 20, 2026 - 00:00 nvd

HIGH 7.5

DescriptionCVE.org

NEMU (OpenXiangShan/NEMU) before v2025.12.r2 contains an improper instruction-validation flaw in its RISC-V Vector (RVV) decoder. The decoder does not correctly validate the funct3 field when decoding vsetvli/vsetivli/vsetvl, allowing certain invalid OP-V instruction encodings to be misinterpreted and executed as vset* configuration instructions rather than raising an illegal-instruction exception. This can be exploited by providing crafted RISC-V binaries to cause incorrect trap behavior, architectural state corruption/divergence, and potential denial of service in systems that rely on NEMU for correct execution or sandboxing.

AnalysisAI

Availability-impacting instruction-decoding flaw in OpenXiangShan NEMU (a RISC-V emulator/reference model) before v2025.12.r2 lets crafted RISC-V binaries slip malformed OP-V encodings past the RVV decoder. Because the decoder fails to validate the funct3 field, invalid vector instructions are misinterpreted and executed as vsetvli/vsetivli/vsetvl configuration instructions instead of raising an illegal-instruction exception, causing incorrect trap behavior, architectural-state divergence, and denial of service. There is no public exploit identified at time of analysis, EPSS is negligible (0.01%), and CISA SSVC records exploitation status as none.

Technical ContextAI

NEMU is the emulator/architectural reference model of the OpenXiangShan open-source RISC-V processor project, used to execute RISC-V binaries and to differentially validate the XiangShan RTL. The defect lives in the RISC-V Vector (RVV) extension decoder (src/isa/riscv64/instr/rvv/decode.h), where instruction dispatch relies on matching bit-field patterns including funct3. The vset* family (vsetvli/vsetivli/vsetvl) shares major opcode OP-V (0x57) with arithmetic vector instructions and is distinguished by funct3; when funct3 is not correctly checked, certain reserved/invalid OP-V encodings alias onto the vset* decode path. The upstream fix (PR #958, commit 481de637) tightens the decode tables in the vopmvx/vopmvv helpers so illegal encodings are rejected. Note that the assigned CWE-131 (Incorrect Calculation of Buffer Size) appears mismatched with the actual root cause, which is improper validation of an instruction-encoding field (closer to improper input/instruction validation); treat the CWE as unreliable metadata here.

RemediationAI

Vendor-released patch: upgrade NEMU to v2025.12.r2 or later, which includes the corrected RVV decode tables. The authoritative fix is PR https://github.com/OpenXiangShan/NEMU/pull/958 and commit https://github.com/OpenXiangShan/NEMU/commit/481de637d5fc5838356caee80a79e56a33754039; teams building NEMU from source can cherry-pick that commit if they cannot move to the tagged release. If patching must be deferred, do not feed untrusted or attacker-supplied RISC-V binaries to NEMU and restrict emulation to vetted workloads; where NEMU is used for differential testing against XiangShan RTL, treat any decode divergence as a validation failure rather than a benign mismatch. These controls trade off throughput and the ability to fuzz arbitrary binaries, but they close the only realistic exposure path (untrusted binary input) until the upgrade is applied.