EUVD-2026-23958
GHSA-729m-5x6m-wwxv
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionNVD
In OpenXiangShan NEMU prior to 55295c4, when running with RVH (Hypervisor extension) enabled, a VS-mode guest write to the supervisor interrupt-enable CSR (sie) may be handled incorrectly and can influence machine-level interrupt enable state (mie). This breaks privilege/virtualization isolation and can lead to denial of service or privilege-boundary violation in environments relying on NEMU for correct interrupt virtualization.
AnalysisAI
OpenXiangShan NEMU emulator's RISC-V Hypervisor extension implementation allows VS-mode guest writes to the sie (supervisor interrupt-enable) CSR to corrupt machine-level mie state, breaking privilege isolation between virtualization layers. Fixed in commit 55295c4 per GitHub PR #938. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Verify whether OpenXiangShan NEMU is deployed in your environment-check development, research, and virtualization infrastructure inventories. Within 7 days: For affected deployments, isolate NEMU instances from network access and restrict to trusted development networks only; contact your RISC-V tools vendor for interim mitigation guidance. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today