CVE-2026-29645

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-29645
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-29645.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-29645
Published
2026-04-20T00:00:00Z
Modified
2026-08-12T16:24:57.013626Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

NEMU (OpenXiangShan/NEMU) before v2025.12.r2 contains an improper instruction-validation flaw in its RISC-V Vector (RVV) decoder. The decoder does not correctly validate the funct3 field when decoding vsetvli/vsetivli/vsetvl, allowing certain invalid OP-V instruction encodings to be misinterpreted and executed as vset* configuration instructions rather than raising an illegal-instruction exception. This can be exploited by providing crafted RISC-V binaries to cause incorrect trap behavior, architectural state corruption/divergence, and potential denial of service in systems that rely on NEMU for correct execution or sandboxing.

Database specific 
{
    "cna_assigner": "mitre",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29645.json"
}
References

Affected packages

Git / github.com/openxiangshan/nemu

Affected ranges

Type
GIT
Repo
https://github.com/openxiangshan/nemu
Events
Introduced
304d1da6a1bae861be9dbf2f6a299cf1c47f383d
Fixed
481de637d5fc5838356caee80a79e56a33754039
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:xiangshan:nemu:2025.12:r1:*:*:*:*:*:*",
    "source": [
        "CPE_STRING",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "2025.12-r1"
        },
        {
            "last_affected": "2025.12-r1"
        }
    ]
}

Affected versions

2025.*
2025.12-r1
v2025.*
v2025.12.r1

Database specific

vanir_signatures_modified 
"2026-08-12T16:24:57Z"
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-29645.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 3517.0,
            "function_hash": "50834913755908956887293910371665530495"
        },
        "id": "CVE-2026-29645-1418f832",
        "source": "https://github.com/openxiangshan/nemu/commit/481de637d5fc5838356caee80a79e56a33754039",
        "target": {
            "function": "def_THelper",
            "file": "src/isa/riscv64/instr/rvv/decode.h"
        }
    },
    {
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 3483.0,
            "function_hash": "24588721114379366516345712678003273244"
        },
        "id": "CVE-2026-29645-47889a9d",
        "source": "https://github.com/openxiangshan/nemu/commit/481de637d5fc5838356caee80a79e56a33754039",
        "target": {
            "function": "def_THelper",
            "file": "src/isa/riscv64/instr/rvv/decode.h"
        }
    },
    {
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "186451324716102190972272071777021467080",
                "229570981201066192739628394813697023333",
                "132071856606749338946419900215730130863",
                "186451324716102190972272071777021467080",
                "229570981201066192739628394813697023333",
                "247603470448565063390777857171839702161",
                "322746400276181205856657891894242633078",
                "137468751287563319557364335998960762387",
                "100213248681997610596256811947574100100",
                "274932493952440577236124947020996803077",
                "186127698557519673345741016229739660787",
                "325572569331760299469915077948329398315",
                "109942038229890815547476116952404105378",
                "137181365460926217368801053239941746773",
                "127266322390854122349285229130016279176",
                "95089221874248222804286126970810762942",
                "18965833649978219703230680148386518957",
                "167487843857750677704134367455240108339",
                "238584700931123364394569788698639272182",
                "203039311245571140773994373311846990503",
                "331092338172181110928374156392414411016",
                "292332213698362928820480435518140015252",
                "246930727414863390132532104043136519305",
                "58663475041318529246635698343182346774",
                "229050973800706818573142299085289025325",
                "298468709598194239040696117087400515",
                "244362994731705040120320154003066756715",
                "262884823143525010375361286087472447350",
                "218338611472923864689336719528282063340",
                "184834275751066826559551513622269484968",
                "85989341715439753882872678853312061328",
                "118873928335077854386484288481004995642",
                "184479131259141826728388788938043923278",
                "336446458999131828933662515785525785037",
                "313539753977305908031829827012703023806",
                "139033953176906583302322010749631546901",
                "274932493952440577236124947020996803077",
                "68111385229264506927672077237264538133",
                "16625862727491154684886155300607679957",
                "64414056077635942418250290525166821001",
                "90530142601496853616672834680695542839",
                "309159293240473950483460901373532618792",
                "118431433153021859218816168714902652743",
                "276525100126957573901194296491186705645",
                "172957600753516473743070292522836200861",
                "149605954086344586250659080774853784887",
                "168051098397139842562577482037386913553",
                "172638255346239029027084767105208091355",
                "137181365460926217368801053239941746773",
                "127266322390854122349285229130016279176",
                "95089221874248222804286126970810762942",
                "18965833649978219703230680148386518957",
                "167487843857750677704134367455240108339",
                "238584700931123364394569788698639272182",
                "203039311245571140773994373311846990503",
                "331092338172181110928374156392414411016"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2026-29645-9ea10220",
        "source": "https://github.com/openxiangshan/nemu/commit/481de637d5fc5838356caee80a79e56a33754039",
        "target": {
            "file": "src/isa/riscv64/instr/rvv/decode.h"
        }
    }
]