CVE-2026-29642
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2026-29642 is a high-severity Internal Asset Exposed to Unsafe Debug Access Level or State (CWE-1244) vulnerability. Its CVSS base score is 7.8 (High).
Operationally, ranked at the 2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-29642 is a vulnerability in the XiangShan open-source RISC-V processor implementation, affecting versions up to commit aecf601e803bfd2371667a3fb60bfcd83c333027 (dated 2024-11-19). It stems from improper handling of reads and writes to the menvcfg control and status register (CSR) in Machine mode (M-mode), such as via csrrs instructions. These operations can unexpectedly set reserved WPRI bits in the xstatus status view to 1, violating RISC-V specifications that define WPRI fields as "writes preserve values, reads ignore values." Such fields must remain unmodified by software manipulating other CSRs, and menvcfg itself contains multiple WPRI bits. The issue is tracked under CWE-1244 with a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2026-04-20.
A local attacker capable of executing privileged CSR operations—or inducing firmware to do so—can exploit this flaw with low complexity. Exploitation involves performing crafted menvcfg accesses in M-mode, leading to high-impact confidentiality, integrity, and availability effects through unauthorized modification of reserved processor state bits.
Mitigation is available via XiangShan commit 5e3dd63 on GitHub, which addresses the issue post-affected version. Additional details are in GitHub issue #3934. RISC-V privileged ISA documentation at the referenced URLs outlines machine-mode CSRs and WPRI field behaviors.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-23954
Vulnerability Data
A local attacker who can execute privileged CSR operations (or can induce firmware to do so) performs carefully crafted reads/writes to menvcfg (e.g., csrrs in M-mode). On affected XiangShan versions (commit aecf601e803bfd2371667a3fb60bfcd83c333027, 2024-11-19), these menvcfg accesses can unexpectedly set WPRI…
more
(reserved) bits in the status view (xstatus) to 1. RISC-V defines WPRI fields as "writes preserve values, reads ignore values," i.e., they must not be modified by software manipulating other fields, and menvcfg itself contains multiple WPRI fields.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations on logical access, directly stopping incorrect debug access levels from being granted to untrusted agents.
Requires least-privilege assignment of access rights, preventing over-privileged debug states on internal assets.
Mandates restrictive, approved configuration settings that would block unsafe debug access level assignments.
Requires application of security engineering principles such as least privilege and isolation during design of debug mechanisms.
Isolates security functions from non-security functions, reducing exposure of internal assets through debug paths.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure development practices throughout the life cycle are the primary means of avoiding unsafe debug access assignments.
Defining and enforcing least-privilege access permissions directly prevents incorrect debug access levels from being assigned.
Configuration management practices ensure debug interfaces receive the intended access-level settings.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect unsafe debug states, but testing alone does not prevent the design flaw.
Privileged utility programs may include debug tools, but the control does not address hardware debug access levels.
Privileged access rights management can limit debug-level access but does not specifically address hardware debug interface misconfiguration.
Secure development lifecycle can include debug interface design reviews but does not guarantee correct access-level assignment.
Secure system architecture principles can require proper debug port isolation, yet the control is broader than this specific weakness.
Information access restriction can reduce exposure of internal assets but does not cover physical debug port access levels.