libriscv: Out of bounds read vuln in the ELF parser (Denial of service)
libriscv 1.17 is the affected version when its ELF loader loads a crafted binary with a manipulated section header offset. Fixed in 1.18.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 1.18
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- 1 proof of concept on GitHub
Summary
libriscv, a RISC-V sandbox and emulator, is affected by an out-of-bounds read flaw in its ELF binary parser that can crash the host process and, under certain memory layouts, could potentially expose host memory to the guest program.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
libriscv is a RISC-V sandbox and emulator. Prior to 1.18, a crafted ELF binary can cause out-of-bounds reads in the host emulator. `Memory<W>::binary_loader` checks `PT_LOAD` program-header bounds, but `Memory<W>::serialize_execute_segment` trusts section-header `sh_offset` and `sh_size` when locating `.text` without verifying the file range against `m_binary.size()`; `Memory<W>::lookup()` has a similar section-table problem. Malformed `.text` or `.symtab` offsets can therefore bypass the program-header checks and point outside the binary buffer, crashing rvlinux. With suitable memory layout or integer overflow, out-of-buffer host heap memory may instead be mapped into the guest by `create_execute_segment()`, potentially exposing host memory. The reported reproducer demonstrates a host SIGSEGV, while memory disclosure through grooming is described as possible rather than demonstrated. This issue is fixed in version 1.18.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- libriscv libriscv
fixed in 1.18
References 5
GitHub · libriscv/libriscv
GitHub · 0Linear/CVE-2026-62958
Questions about CVE-2026-62958
What does this mean?
A specially crafted ELF binary with a manipulated section header offset can make the libriscv ELF loader read memory outside its intended bounds. The impact listed is a crash of the host emulator, which is a denial of service.Source: github.com
Am I affected, and how do I check?
The affected version listed is 1.17, and the condition is loading a crafted ELF binary with a manipulated section header offset. Check the libriscv version in the build or dependency manifest to see which release is in use.Source: github.com
What should I do about it?
Upgrade libriscv to version 1.18, the listed fixed version.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. Public exploit code exists (a proof of concept on GitHub).Source: cve.now feed data