{"id":"CVE-2026-62958","aliases":[],"cve":{"records":[{"id":"CVE-2026-62958","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-07-14T22:32:17.732Z","published":"2026-10-30T20:44:21.663Z","modified":"2026-10-30T20:44:21.663Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-30T20:44:21.663Z"}],"references":[{"url":"https://github.com/libriscv/libriscv/security/advisories/GHSA-gm4g-6c78-gr3w","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/libriscv/libriscv/commit/61ef9ca82c8876dd80b33780893ba512af780e93","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/libriscv/libriscv/commit/7bd1c189f9f9d54368cde096b07b194ad680f9fa","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/libriscv/libriscv/releases/tag/v1.18","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-20","description":"CWE-20: Improper Input Validation","source":"GitHub_M"},{"id":"CWE-125","description":"CWE-125: Out-of-bounds Read","source":"GitHub_M"}],"applicability":[],"prioritization":[]},"title":"libriscv: Out of bounds read vuln in the ELF parser (Denial of service)","titleSource":"GitHub_M","descriptionSource":"GitHub_M","description":"libriscv is a RISC-V sandbox and emulator. Prior to 1.18, a crafted ELF binary can cause out-of-bounds reads in the host emulator. `Memory<W>::binary_loader` checks `PT_LOAD` program-header bounds, but `Memory<W>::serialize_execute_segment` trusts section-header `sh_offset` and `sh_size` when locating `.text` without verifying the file range against `m_binary.size()`; `Memory<W>::lookup()` has a similar section-table problem. Malformed `.text` or `.symtab` offsets can therefore bypass the program-header checks and point outside the binary buffer, crashing rvlinux. With suitable memory layout or integer overflow, out-of-buffer host heap memory may instead be mapped into the guest by `create_execute_segment()`, potentially exposing host memory. The reported reproducer demonstrates a host SIGSEGV, while memory disclosure through grooming is described as possible rather than demonstrated. This issue is fixed in version 1.18.","score":7.9,"severity":"high","published":"2026-10-30T20:44:21.663Z","modified":"2026-10-30T20:44:21.663Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"libriscv","name":"libriscv","platforms":[],"versions":[{"version":"< 1.18","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-62958"}],"remediation":[],"references":["https://github.com/libriscv/libriscv/security/advisories/GHSA-gm4g-6c78-gr3w","https://github.com/libriscv/libriscv/commit/61ef9ca82c8876dd80b33780893ba512af780e93","https://github.com/libriscv/libriscv/commit/7bd1c189f9f9d54368cde096b07b194ad680f9fa","https://github.com/libriscv/libriscv/releases/tag/v1.18"],"sources":[{"name":"CVE","id":"CVE-2026-62958","modified":"2026-10-30T20:44:21.663Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-62958"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:H","score":7.9}],"sourceAffected":[],"observedAt":"2026-10-30T21:32:14.274Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T09:10:30.844Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T21:50:33.117Z","attemptedAt":"2026-10-30T21:50:33.117Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T21:50:33.169Z","attemptedAt":"2026-10-30T21:50:33.169Z"},{"source":"EUVD","status":"no-result","checkedAt":"2026-10-30T21:50:33.120Z","attemptedAt":"2026-10-30T21:50:33.120Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T21:50:32.966Z","attemptedAt":"2026-10-30T21:50:32.966Z"}],"evidence":[{"source":"NVD","id":"CVE-2026-62958","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62958","modified":"2026-10-30T21:17:14.840","score":7.9,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:H","checkedAt":"2026-10-30T21:50:33.117Z"}],"aiSummary":{"text":"libriscv versions prior to 1.18 have an out-of-bounds read vulnerability in the ELF parser, potentially causing a denial of service or exposing host memory. A crafted ELF binary can bypass program-header checks. The issue is fixed in version 1.18.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-31T05:01:03.372Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-62958"}]}}