CVE-2026-29645

NEMU (OpenXiangShan/NEMU) before v2025.12.r2 contains an improper instruction-validation flaw in its RISC-V Vector (RVV) decoder. The decoder does not correctly validate the funct3 field when decoding vsetvli/vsetivli/vsetvl, allowing certain invalid OP-V instruction encodings to be misinterpreted and executed as vset* configuration instructions rather than raising an illegal-instruction exception. This can be exploited by providing crafted RISC-V binaries to cause incorrect trap behavior, architectural state corruption/divergence, and potential denial of service in systems that rely on NEMU for correct execution or sandboxing.

• CWE-131
• CWE-1287

• https://docs.riscv.org/reference/isa/unpriv/v-st-ext.htmlProduct
• https://github.com/OpenXiangShan/NEMU/commit/481de637d5fc5838356caee80a79e56a33754039Patch
• https://github.com/OpenXiangShan/NEMU/issues/952Issue Tracking
• https://github.com/OpenXiangShan/NEMU/pull/958Issue Tracking

Published

Apr 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-29628A stack overflow in the experimental/tinyobj_loader_opt.h fi…6.2
• CVE-2026-2963A vulnerability was determined in Jinher OA C6 up to 2026021…6.3
• CVE-2026-2964A vulnerability was identified in higuma web-audio-recorder-…9.8
• CVE-2026-29642A local attacker who can execute privileged CSR operations (…7.8
• CVE-2026-29643XiangShan (Open-source high-performance RISC-V processor) co…7.1
• CVE-2026-29644XiangShan (open-source high-performance RISC-V processor) co…5.3
• CVE-2026-29646In OpenXiangShan NEMU prior to 55295c4, when running with RV…9.8
• CVE-2026-29647In OpenXiangShan NEMU, insufficient Smstateen permission enf…6.5
• CVE-2026-29648In OpenXiangShan NEMU, when Smstateen is enabled, clearing m…8.8
• CVE-2026-29649NEMU contains an implementation flaw in its RISC-V Hyperviso…9.8
• CVE-2026-2965A security flaw has been discovered in 07FLYCMS, 07FLY-CMS a…2.4
• CVE-2026-2966A weakness has been identified in Cesanta Mongoose up to 7.2…3.7