OpenXiangShan NEMU EUVD-2026-23958

Exploitation requires the attacker to execute code within a RISC-V guest virtual machine running under OpenXiangShan NEMU with the RVH (Hypervisor extension) feature explicitly enabled at emulator build/runtime. The attacker must achieve code execution at VS-mode privilege level within the guest-typically requiring compromise of a guest OS or legitimate access to deploy applications in the guest environment. NEMU must be compiled with Hypervisor extension support and launched with virtualization features active; default NEMU configurations without RVH enabled are not vulnerable. Limiting factors include: the specialized nature of RISC-V emulator deployment (primarily research/development environments, not production infrastructure), the need for prior guest-level code execution (this is not a remote code execution vulnerability in NEMU itself), and the requirement for specific emulator configuration flags. The CVSS network vector (AV:N) does not reflect realistic access-NEMU is not a network service, and exploitation begins from within a local guest VM context.

The CVSS 9.8 Critical score (AV:N/AC:L/PR:N/UI:N) appears misaligned with actual exploitation conditions and real-world deployment context. The network attack vector (AV:N) is questionable-NEMU is an emulator typically used in development/research environments, not a network-facing service. Realistic exploitation requires an attacker to execute code within a RISC-V guest VM running under NEMU with RVH enabled, which is a highly specialized scenario. The EPSS score of 0.03% (9th percentile) strongly supports low real-world risk, indicating security researchers assess this as unlikely to be exploited despite the high CVSS rating. No CISA KEV listing confirms this is not being actively exploited. SSVC assessment suggests 'defer' priority: exploitation status is none (no POC or KEV), technical impact is total (privilege escalation from guest to host emulator context), but automatable exploitation is unlikely given the specialized environment requirements. The primary risk is to RISC-V hardware verification teams, academic researchers, and early-stage SoC developers using NEMU for virtualization testing-not production infrastructure. CRITICAL DATA GAP: CVSS network vector conflicts with emulator usage model; affected version range beyond 'prior to 55295c4' not enumerated in structured form; no CVE-assigned severity justification for AV:N rating.

A malicious RISC-V guest operating system or application running in VS-mode (virtualized supervisor mode) under NEMU with RVH enabled crafts a write to the sie CSR register with specific bit patterns. Due to incorrect emulation logic, NEMU propagates this write to the machine-mode mie register instead of constraining it to virtualized interrupt state. The attacker gains control over machine-level interrupt enables, allowing them to disable critical interrupts (denial of service) or manipulate interrupt delivery to escalate privileges within the emulator host context. Publicly available exploit code has not been identified, but the GitHub issue #951 and PR #938 provide sufficient technical detail for exploit development by researchers familiar with RISC-V architecture.