CVE-2026-29643

OVERVIEW CVE-2026-29643 is an improper exception handling vulnerability in XiangShan, an open-source high-performance RISC-V processor, affecting versions from commit edb1dfaf7d290ae99724594507dc46c2c2125384 dated 2024-11-28. The flaw exists within the CSR (Control and Status Register) subsystem where certain sequences of CSR operations targeting non-existent or custom CSR addresses fail to reliably transfer control to the configured trap handler, potentially causing the processor core to enter a hung or unrecoverable state. SEVERITY This vulnerability carries a CVSS score of 7.1 (HIGH) with a local attack vector requiring low complexity and low privilege requirements. The attack involves no user interaction and impacts the integrity and availability of the affected system. While the confidentiality impact is minimal, the potential for high integrity compromise and denial of service through control-flow disruption and architectural state inconsistency makes this a significant concern for systems utilizing the affected XiangShan processor. EXPLOITATION STATUS There is no evidence of active exploitation or public exploit code availability. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog and remains inactive on industry hot lists. However, the extremely low EPSS score of 0.000120000 and FAUCET risk score of 37.0/100 suggest minimal current real-world exploitation risk, though organizations deploying XiangShan-based systems should prioritize patching to address the local denial of service and processor stability concerns.