libriscv up to 1.17 ELF Binary Loader Memory::binary_loader input validation

Summaryinfo

A vulnerability categorized as problematic has been discovered in libriscv up to 1.17. The affected element is the function Memory::binary_loader of the component ELF Binary Loader. The manipulation results in input validation. This vulnerability is reported as CVE-2026-62958. The attack requires a local approach. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as problematic, was found in libriscv up to 1.17. Affected is the function Memory::binary_loader of the component ELF Binary Loader. The manipulation with an unknown input leads to a input validation vulnerability. CWE is classifying the issue as CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

libriscv is a RISC-V sandbox and emulator. Prior to 1.18, a crafted ELF binary can cause out-of-bounds reads in the host emulator. `Memory<W>::binary_loader` checks `PT_LOAD` program-header bounds, but `Memory<W>::serialize_execute_segment` trusts section-header `sh_offset` and `sh_size` when locating `.text` without verifying the file range against `m_binary.size()`; `Memory<W>::lookup()` has a similar section-table problem. Malformed `.text` or `.symtab` offsets can therefore bypass the program-header checks and point outside the binary buffer, crashing rvlinux. With suitable memory layout or integer overflow, out-of-buffer host heap memory may instead be mapped into the guest by `create_execute_segment()`, potentially exposing host memory. The reported reproducer demonstrates a host SIGSEGV, while memory disclosure through grooming is described as possible rather than demonstrated. This issue is fixed in version 1.18.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-62958 since 07/15/2026. The exploitability is told to be easy. Local access is required to approach this attack. Technical details are known, but there is no available exploit.

Upgrading to version 1.18 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• libriscv

Version

• 1.0
• 1.1
• 1.2
• 1.3
• 1.4
• 1.5
• 1.6
• 1.7
• 1.8
• 1.9
• 1.10
• 1.11
• 1.12
• 1.13
• 1.14
• 1.15
• 1.16
• 1.17

Website

• Product: https://github.com/libriscv/libriscv/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion