Read the docs
TI-2026-83403 Aliases CVE-2026-62958

Out-of-bounds read in libriscv ELF parser crashes the host emulator

Priority HIGH 68CWE-125Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

libriscv before 1.18 is affected. The ELF loader trusts section header offsets and sizes without checking them against the binary size, which causes an out-of-bounds read (CWE-125). A local attacker with no privileges can supply a crafted ELF binary to crash the host emulator, and memory disclosure is possible but not demonstrated.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Description from the CNA

libriscv is a RISC-V sandbox and emulator. Prior to 1.18, a crafted ELF binary can cause out-of-bounds reads in the host emulator. `Memory<W>::binary_loader` checks `PT_LOAD` program-header bounds, but `Memory<W>::serialize_execute_segment` trusts section-header `sh_offset` and `sh_size` when locating `.text` without verifying the file range against `m_binary.size()`; `Memory<W>::lookup()` has a similar section-table problem. Malformed `.text` or `.symtab` offsets can therefore bypass the program-header checks and point outside the binary buffer, crashing rvlinux. With suitable memory layout or integer overflow, out-of-buffer host heap memory may instead be mapped into the guest by `create_execute_segment()`, potentially exposing host memory. The reported reproducer demonstrates a host SIGSEGV, while memory disclosure through grooming is described as possible rather than demonstrated. This issue is fixed in version 1.18.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00205 10th percentileScored 2026-11-07
Fix Fixed libriscv (libriscv): 1.18

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
libriscvlibriscvbefore 1.181.18Patch availableCNA
  • libriscv Vendorlibriscv Affected before 1.18 Fixed in 1.18 Patch available CNA

Remediation

This issue is fixed in libriscv version 1.18.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

  • Fix · CNA libriscv (libriscv) Fixed in 1.18

Timeline

  1. 2026-10-30 Threatist record created from CVE-2026-62958
  2. 2026-11-01 Priority changed: MEDIUM → LOW
  3. 2026-11-02 CISA SSVC decision points changed
  4. 2026-11-02 Priority changed: LOW → HIGH

References

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences