Skip to main content
← All vulnerabilities
CVE-2026-62958

libriscv: Out of bounds read vuln in the ELF parser (Denial of service)

libriscv 1.17 is the affected version when its ELF loader loads a crafted binary with a manipulated section header offset. Fixed in 1.18.

Published
Last modified
published
Not listed in CISA KEV
Specific setups only
Fix
Fixed in 1.18
1 proof of concept on GitHub

Summary

libriscv, a RISC-V sandbox and emulator, is affected by an out-of-bounds read flaw in its ELF binary parser that can crash the host process and, under certain memory layouts, could potentially expose host memory to the guest program.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

libriscv is a RISC-V sandbox and emulator. Prior to 1.18, a crafted ELF binary can cause out-of-bounds reads in the host emulator. `Memory<W>::binary_loader` checks `PT_LOAD` program-header bounds, but `Memory<W>::serialize_execute_segment` trusts section-header `sh_offset` and `sh_size` when locating `.text` without verifying the file range against `m_binary.size()`; `Memory<W>::lookup()` has a similar section-table problem. Malformed `.text` or `.symtab` offsets can therefore bypass the program-header checks and point outside the binary buffer, crashing rvlinux. With suitable memory layout or integer overflow, out-of-buffer host heap memory may instead be mapped into the guest by `create_execute_segment()`, potentially exposing host memory. The reported reproducer demonstrates a host SIGSEGV, while memory disclosure through grooming is described as possible rather than demonstrated. This issue is fixed in version 1.18.

Timeline

  1. CVE published
  2. First seen by cve.now

Affected versions

  • libriscv libriscv

    fixed in 1.18

References 5

GitHub · libriscv/libriscv

GitHub · 0Linear/CVE-2026-62958

FAQ

Questions about CVE-2026-62958

What does this mean?

A specially crafted ELF binary with a manipulated section header offset can make the libriscv ELF loader read memory outside its intended bounds. The impact listed is a crash of the host emulator, which is a denial of service.Source: github.com

Am I affected, and how do I check?

The affected version listed is 1.17, and the condition is loading a crafted ELF binary with a manipulated section header offset. Check the libriscv version in the build or dependency manifest to see which release is in use.Source: github.com

What should I do about it?

Upgrade libriscv to version 1.18, the listed fixed version.Source: github.com

Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. Public exploit code exists (a proof of concept on GitHub).Source: cve.now feed data