{"id":"CVE-2026-62958","title":"libriscv: Out of bounds read vuln in the ELF parser (Denial of service)","summary":"libriscv is a RISC-V sandbox and emulator. Prior to 1.18, a crafted ELF binary can cause out-of-bounds reads in the host emulator. `Memory<W>::binary_loader` checks `PT_LOAD` program-header bounds, but `Memory<W>::serialize_execute_segme…","severity":"high","cvss":7.9,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:H","cvssSource":"cna","cwe":["CWE-20","CWE-125"],"vendor":"libriscv","product":"libriscv","affected":["libriscv < 1.18"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-02T14:54:34.516881Z"},"exploitAvailable":true,"published":"2026-10-30","updated":"2026-11-02","sourceUpdated":"2026-11-02T14:55:00.894Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-62958","references":[{"url":"https://github.com/libriscv/libriscv/security/advisories/GHSA-gm4g-6c78-gr3w","label":"https://github.com/libriscv/libriscv/security/advisories/GHSA-gm4g-6c78-gr3w"},{"url":"https://github.com/libriscv/libriscv/commit/61ef9ca82c8876dd80b33780893ba512af780e93","label":"https://github.com/libriscv/libriscv/commit/61ef9ca82c8876dd80b33780893ba512af780e93"},{"url":"https://github.com/libriscv/libriscv/commit/7bd1c189f9f9d54368cde096b07b194ad680f9fa","label":"https://github.com/libriscv/libriscv/commit/7bd1c189f9f9d54368cde096b07b194ad680f9fa"},{"url":"https://github.com/libriscv/libriscv/releases/tag/v1.18","label":"https://github.com/libriscv/libriscv/releases/tag/v1.18"}],"tags":["cve.org","exploit-available"],"epss":0.00205,"epssPercentile":0.10562,"exploits":{"github":1,"githubRepos":["https://github.com/0Linear/CVE-2026-62958"],"checkedAt":"2026-11-07T18:22:54.659Z"},"ingestedAt":"2026-11-05T19:30:42.675Z","slug":"CVE-2026-62958","body":"## Overview\n\nlibriscv is a RISC-V sandbox and emulator. Prior to 1.18, a crafted ELF binary can cause out-of-bounds reads in the host emulator. `Memory<W>::binary_loader` checks `PT_LOAD` program-header bounds, but `Memory<W>::serialize_execute_segment` trusts section-header `sh_offset` and `sh_size` when locating `.text` without verifying the file range against `m_binary.size()`; `Memory<W>::lookup()` has a similar section-table problem. Malformed `.text` or `.symtab` offsets can therefore bypass the program-header checks and point outside the binary buffer, crashing rvlinux. With suitable memory layout or integer overflow, out-of-buffer host heap memory may instead be mapped into the guest by `create_execute_segment()`, potentially exposing host memory. The reported reproducer demonstrates a host SIGSEGV, while memory disclosure through grooming is described as possible rather than demonstrated. This issue is fixed in version 1.18.\n\n## Affected\n\n- `libriscv < 1.18`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":43.5,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[]}