Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-62958— libriscv: Out of bounds read vuln in the ELF parser (Denial of service)

Quick assessment

Affected
libriscv libriscv
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

libriscv 是一个 RISC-V 沙箱与模拟器。在 1.18 版本之前，精心构造的 ELF 二进制文件可能导致宿主模拟器发生越界读取漏洞。具体而言， 会检查 程序头段的边界，但 在定位 段时，直接信任段头中的 和 ，而未将文件范围与 进行校验； 也存在类似的段表问题。因此，畸形的 或 偏移量可绕过程序头段检查，指向二进制缓冲区之外，导致 rvlinux 崩溃。若配合特定的内存布局或整数溢出， 还可能将宿主堆内存映射到客户机中，从而潜在地泄露宿主内存。已提交的复现示例展示了宿主端触发 SIGSEGV（段错误）的

CVSS 7.9 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-62958

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
libriscv: Out of bounds read vuln in the ELF parser (Denial of service)
Source: CVE Program / CVE List V5
Vulnerability Description
libriscv is a RISC-V sandbox and emulator. Prior to 1.18, a crafted ELF binary can cause out-of-bounds reads in the host emulator. `Memory<W>::binary_loader` checks `PT_LOAD` program-header bounds, but `Memory<W>::serialize_execute_segment` trusts section-header `sh_offset` and `sh_size` when locating `.text` without verifying the file range against `m_binary.size()`; `Memory<W>::lookup()` has a similar section-table problem. Malformed `.text` or `.symtab` offsets can therefore bypass the program-header checks and point outside the binary buffer, crashing rvlinux. With suitable memory layout or integer overflow, out-of-buffer host heap memory may instead be mapped into the guest by `create_execute_segment()`, potentially exposing host memory. The reported reproducer demonstrates a host SIGSEGV, while memory disclosure through grooming is described as possible rather than demonstrated. This issue is fixed in version 1.18.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
输入验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
libriscv libriscv < 1.18 -

II. Public POCs for CVE-2026-62958

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-62958

请登录查看更多情报信息。

Other References for CVE-2026-62958 (4)

IV. Related Vulnerabilities

Same weakness: CWE-20