{"affected":[{"product":"libriscv","source":"CNA: GitHub_M","vendor":"libriscv","versions":[{"status":"affected","version":"< 1.18"}]}],"cveId":"CVE-2026-62958","cwes":["CWE-20","CWE-125"],"description":"libriscv is a RISC-V sandbox and emulator. Prior to 1.18, a crafted ELF binary can cause out-of-bounds reads in the host emulator. `Memory<W>::binary_loader` checks `PT_LOAD` program-header bounds, but `Memory<W>::serialize_execute_segment` trusts section-header `sh_offset` and `sh_size` when locating `.text` without verifying the file range against `m_binary.size()`; `Memory<W>::lookup()` has a similar section-table problem. Malformed `.text` or `.symtab` offsets can therefore bypass the program-header checks and point outside the binary buffer, crashing rvlinux. With suitable memory layout or integer overflow, out-of-buffer host heap memory may instead be mapped into the guest by `create_execute_segment()`, potentially exposing host memory. The reported reproducer demonstrates a host SIGSEGV, while memory disclosure through grooming is described as possible rather than demonstrated. This issue is fixed in version 1.18.","epss":{"date":"2026-11-02","percentile":0.10497,"score":0.00205},"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://github.com/libriscv/libriscv/security/advisories/GHSA-gm4g-6c78-gr3w"}],"kev":null,"metrics":[{"score":7.9,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:H","version":"3.1"}],"modifiedAt":1793631300894,"publishedAt":1793393061663,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/libriscv/libriscv/security/advisories/GHSA-gm4g-6c78-gr3w"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/libriscv/libriscv/commit/61ef9ca82c8876dd80b33780893ba512af780e93"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/libriscv/libriscv/commit/7bd1c189f9f9d54368cde096b07b194ad680f9fa"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/libriscv/libriscv/releases/tag/v1.18"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://github.com/libriscv/libriscv/security/advisories/GHSA-gm4g-6c78-gr3w"}],"remediation":[],"revision":"5beeefb6681213a4210a463c0e210aff6e9fecbb94d0d429f1195a46c88163cd","sources":[{"modifiedAt":1793631300894,"name":"CNA: GitHub_M","retrievedAt":1793632147209,"url":"https://www.cve.org/CVERecord?id=CVE-2026-62958"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793632151023,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-62958"}],"ssvc":{"assessedAt":1793631274516,"automatable":"no","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"libriscv: Out of bounds read vuln in the ELF parser (Denial of service)","updatedAt":1793632151023}