Live › vulnerability › CVE-2026-62958
libriscv is a RISC-V sandbox and emulator library. A crafted ELF binary with malformed section headers can make the host emulator read past its input buffer, crashing the process and possibly exposing host heap memory to the guest program.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 21:25 UTC. All times on this page are UTC.
Applications that embed libriscv and load ELF binaries supplied by untrusted users are exposed, since the malformed section headers are what trigger the flaw. Projects that only run trusted binaries they built themselves are less exposed. The sources do not say which downstream products bundle libriscv.
No product ranges from the sources yet.
1.18 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
libriscv is a RISC-V sandbox and emulator. Prior to 1.18, a crafted ELF binary can cause out-of-bounds reads in the host emulator. Memory<W>::binary_loader checks PT_LOAD program-header bounds, but Memory<W>::serialize_execute_segment trusts section-header sh_offset and sh_size when locating .text without verifying the file range against m_binary.size(); Memory<W>::lookup() has a similar section-table problem. Malformed .text or .symtab offsets can therefore bypass the program-header checks and point outside the binary buffer, crashing rvlinux. With suitable memory layout or integer overflow, out-of-buffer host heap memory may instead be mapped into the guest by create_execute_segment(), potentially exposing host memory. The reported reproducer demonstrates a host SIGSEGV, while memory disclosure through grooming is described as possible rather than demonstrated. This issue is fixed in version 1.18.
This page as .md · .json · in your agent: get_signal("CVE-2026-62958")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.