Vulnerability Description
NEMU (OpenXiangShan/NEMU) before v2025.12.r2 contains an improper instruction-validation flaw in its RISC-V Vector (RVV) decoder. The decoder does not correctly validate the funct3 field when decoding vsetvli/vsetivli/vsetvl, allowing certain invalid OP-V instruction encodings to be misinterpreted and executed as vset* configuration instructions rather than raising an illegal-instruction exception. This can be exploited by providing crafted RISC-V binaries to cause incorrect trap behavior, architectural state corruption/divergence, and potential denial of service in systems that rely on NEMU for correct execution or sandboxing.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Xiangshan | Nemu | 2025.12 |
Related Weaknesses (CWE)
References
- https://docs.riscv.org/reference/isa/unpriv/v-st-ext.htmlProduct
- https://github.com/OpenXiangShan/NEMU/commit/481de637d5fc5838356caee80a79e56a337Patch
- https://github.com/OpenXiangShan/NEMU/issues/952Issue Tracking
- https://github.com/OpenXiangShan/NEMU/pull/958Issue Tracking
FAQ
What is CVE-2026-29645?
CVE-2026-29645 is a vulnerability with a CVSS score of 7.5 (HIGH). NEMU (OpenXiangShan/NEMU) before v2025.12.r2 contains an improper instruction-validation flaw in its RISC-V Vector (RVV) decoder. The decoder does not correctly validate the funct3 field when decoding...
How severe is CVE-2026-29645?
CVE-2026-29645 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-29645?
Check the references section above for vendor advisories and patch information. Affected products include: Xiangshan Nemu.