{"id":"CVE-2026-29642","details":"A local attacker who can execute privileged CSR operations (or can induce firmware to do so) performs carefully crafted reads/writes to menvcfg (e.g., csrrs in M-mode). On affected XiangShan versions (commit aecf601e803bfd2371667a3fb60bfcd83c333027, 2024-11-19), these menvcfg accesses can unexpectedly set WPRI (reserved) bits in the status view (xstatus) to 1. RISC-V defines WPRI fields as \"writes preserve values, reads ignore values,\" i.e., they must not be modified by software manipulating other fields, and menvcfg itself contains multiple WPRI fields.","modified":"2026-08-12T03:51:13.274523169Z","published":"2026-04-20T00:00:00Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29642.json"},"references":[{"type":"WEB","url":"https://docs.riscv.org/reference/isa/priv/machine.html"},{"type":"WEB","url":"https://docs.riscv.org/reference/isa/priv/priv-csrs.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29642.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29642"},{"type":"REPORT","url":"https://github.com/OpenXiangShan/XiangShan/issues/3934"},{"type":"FIX","url":"https://github.com/OpenXiangShan/XiangShan/commit/5e3dd63"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/openxiangshan/xiangshan","events":[{"introduced":"0"},{"fixed":"5e3dd63"}],"database_specific":{"source":"REFERENCES"}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-29642.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}