Nemu vulnerabilities

2 known vulnerabilities in Nemu from Xiangshan. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  Nemu: Protection Mechanism Failure

  CVE-2026-29649Apr 20, 2026Xiangshan

  NEMU contains an implementation flaw in its RISC-V Hypervisor CSR handling where henvcfg[7:4] (CBIE/CBCFE/CBZE-related fields) is incorrectly masked/updated based on menvcfg[7:4], so a machine-mode write to menvcfg can implicitly modify the hypervisor's enviro

• 7.5 High severity

  Nemu: Incorrect Calculation of Buffer Size

  CVE-2026-29645Apr 20, 2026Xiangshan

  NEMU (OpenXiangShan/NEMU) before v2025.12.r2 contains an improper instruction-validation flaw in its RISC-V Vector (RVV) decoder. The decoder does not correctly validate the funct3 field when decoding vsetvli/vsetivli/vsetvl, allowing certain invalid OP-V inst