BOOM RISC-V Processor CVE-2026-71694

Exploitation requires the ability to execute arbitrary RISC-V instructions on a processor core implemented using the BOOM RTL at the specific affected commit (v1.2, 2d08d0d8b4563212175212f9db0e69f6e68c9619), whether via simulation (e.g., Verilator, VCS) or FPGA synthesis. The attacker must be able to trigger machine-mode trap entry and execute the MRET instruction with attacker-influenced mstatus register state - this implies at minimum user-mode or supervisor-mode code execution on the affected core. The vulnerability is limited to BOOM-based implementations and does not affect RISC-V processors from other vendors (SiFive, T-Head, etc.) unless they share the same RTL lineage. Systems running standard commercial RISC-V SoCs are not affected. The CVSS-implied network vector (AV:N) and lack of prerequisites (PR:N) are assessed as misclassified; actual exploitation is constrained to environments where an attacker already controls code running on the BOOM simulation or synthesis target.

The CVSS 3.1 base score of 8.8 with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H is internally inconsistent with the described vulnerability. A processor RTL state-machine bug exploited through MRET/MPRV logic is fundamentally a local or at most physical-access attack - a network-accessible, unauthenticated, user-interaction-required (UI:R) framing matching CWE-352 (CSRF) does not map to CSR privilege-restoration flaws in a hardware core. The most plausible explanation is that the CVSS vector and CWE were assigned via an automated classifier that misread 'CSR' as Cross-Site Request rather than Control and Status Register. The EPSS score of 0.29% (22nd percentile) independently signals very low exploitation activity and aligns with a niche academic hardware benchmark rather than a broadly deployed production asset. No CISA KEV listing exists. BOOM is used primarily in university research labs and hardware security competitions; it is not a commercial product running in enterprise infrastructure. Taken together, while the micro-architectural flaw may be real and demonstrable under fuzzing, real-world risk is substantially lower than the CVSS 8.8 headline implies, and the severity metadata should be treated with caution pending vendor correction.

An attacker with the ability to run unprivileged or supervisor-mode code on a system simulating or instantiating the BOOM RISC-V core constructs a crafted instruction sequence that triggers a machine-mode trap and then executes MRET with a specially prepared mstatus state, exploiting the flawed CSR restoration logic to retain or escalate to M-mode privileges. From M-mode, the attacker has unrestricted access to all CSRs, physical memory, and I/O devices, achieving arbitrary code execution at the highest privilege level. No public proof-of-concept exploit has been identified, but the referenced vulnerability report repository suggests the flaw was discovered and documented through processor fuzzing techniques.