CVE-2026-29646

OVERVIEW CVE-2026-29646 is a privilege isolation vulnerability in OpenXiangShan NEMU prior to commit 55295c4 that affects systems running with the RVH (Hypervisor extension) enabled. The flaw allows a VS-mode (virtualized supervisor) guest to incorrectly modify the supervisor interrupt-enable CSR (sie) register in a way that influences machine-level interrupt enable state (mie), effectively breaking virtualization isolation boundaries. SEVERITY This vulnerability carries a CRITICAL CVSS v3.1 score of 9.8 with a network-based attack vector requiring no authentication, low complexity, and no user interaction. The impact is severe across all three dimensions: confidentiality, integrity, and availability are all rated as high. In hypervisor-dependent environments, successful exploitation could enable privilege escalation, denial of service, or unauthorized access to machine-level resources that should remain isolated from guest VMs. EXPLOITATION STATUS The vulnerability is not currently tracked on the KEV catalog and shows no active exploitation in the wild. The EPSS score of 0.00061 indicates minimal near-term exploitation probability. However, the moderate FAUCET Risk Score of 54.0 suggests the vulnerability warrants attention in security patches and system hardening efforts, particularly for organizations deploying NEMU-based virtualization infrastructure.