What is the CVSS score of EUVD-2026-23962?

EUVD-2026-23962 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of OpenXiangShan NEMU are affected by EUVD-2026-23962?

CVE-2026-29648 is a privilege escalation vulnerability in OpenXiangShan NEMU that allows authenticated local attackers to bypass virtualization isolation controls when the Smstateen extension is…

How to fix or mitigate EUVD-2026-23962?

Within 24 hours: Identify all systems running OpenXiangShan NEMU with Smstateen extension enabled and restrict local access to trusted administrators only. Within 7 days: Disable the Smstateen extension if not required for production workloads; document business justification for any systems where it remains enabled. Within 30 days: Monitor vendor advisories for patch availability and prepare deployment procedures; conduct privilege access review for accounts with local NEMU access to enforce least-privilege principle.

OpenXiangShan NEMU EUVD-2026-23962

| CVE-2026-29648 HIGH

Improper Privilege Management (CWE-269)

2026-04-20 mitre

GHSA-2vgw-r373-m9qx

Privilege Escalation N A

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Apr 21, 2026 - 20:22 vuln.today

CVSS changed

Apr 21, 2026 - 20:22 NVD

8.8 (HIGH)

EUVD ID Assigned

Apr 20, 2026 - 21:15 euvd

EUVD-2026-23962

Analysis Generated

Apr 20, 2026 - 21:15 vuln.today

CVE Published

Apr 20, 2026 - 00:00 nvd

HIGH 8.8

DescriptionCVE.org

In OpenXiangShan NEMU, when Smstateen is enabled, clearing mstateen0.ENVCFG does not correctly restrict access to henvcfg and senvcfg. As a result, less-privileged code may read or write these CSRs without the required exception, potentially bypassing intended state-enable based isolation controls in virtualized or multi-privilege environments.

AnalysisAI

Privilege escalation in OpenXiangShan NEMU allows authenticated local attackers to bypass state-enable isolation controls when Smstateen extension is enabled. Clearing mstateen0.ENVCFG fails to properly restrict access to henvcfg and senvcfg Control and Status Registers (CSRs), enabling less-privileged code to read or write privileged configuration registers without triggering required exceptions. This undermines virtualization boundaries and multi-privilege isolation in RISC-V processor emulation environments. EPSS exploitation probability is low (0.02%, 4th percentile), no active exploitation confirmed, and publicly available exploit code exists via GitHub issue #690.

Technical ContextAI

OpenXiangShan NEMU is a RISC-V full-system emulator used for processor design verification and software development. The vulnerability affects the implementation of the Smstateen extension, a RISC-V privileged specification feature that provides state-enable controls to manage access to architectural state across privilege levels. The mstateen0.ENVCFG bit is designed to gate access to environment configuration CSRs (henvcfg for hypervisor mode, senvcfg for supervisor mode). When this bit is cleared, attempts by lower-privilege software to access these CSRs should trigger an illegal instruction exception. The implementation flaw (CWE-269: Improper Privilege Management) allows the access control check to be bypassed, permitting unauthorized CSR manipulation. This breaks the isolation model in environments running hypervisors or nested virtualization where henvcfg controls memory management, interrupt delegation, and other critical hypervisor-visible state.

RemediationAI

Apply the upstream fix available in GitHub pull request https://github.com/OpenXiangShan/XiangShan/pull/3978, which addresses the Smstateen access control logic. Monitor the OpenXiangShan NEMU repository for a tagged release incorporating this fix and update to that version when available. Until a patched version is deployed, implement compensating controls by disabling the Smstateen extension in NEMU configurations if not required for your testing or development workload (trade-off: loses state-enable gating features, but eliminates bypass risk). For multi-tenant NEMU deployments, enforce strict process-level isolation and run each emulation instance under separate user accounts with no shared memory access (trade-off: increases resource overhead, prevents certain shared-state testing scenarios). For security-sensitive workloads requiring Smstateen, consider switching to alternative RISC-V emulators (QEMU, Spike) until NEMU is patched, though this may require test environment reconfiguration and validation of behavioral equivalence. Detailed technical context available at https://docs.riscv.org/reference/isa/priv/smstateen.html.