libriscv: Out-of-bounds read via crafted ELF binary in the loader
Summary
libriscv, a RISC-V sandbox and emulator, does not fully validate section-header offsets and sizes when loading ELF binaries. A crafted ELF file can therefore cause out-of-bounds reads in the host emulator, which crashes the host process. The reported reproducer demonstrates a host crash; exposure of host memory through heap grooming is described as possible but has not been demonstrated. Exploitation requires that the host application loads an untrusted ELF binary.
Affected
- libriscv versions prior to 1.18
- Applications that embed libriscv and load untrusted RISC-V ELF binaries
Fixed in
- Version 1.18
Workaround
Unknown.
Exploitation
- Not known to be exploited in the wild.
- The CISA KEV catalogue was not checked directly.
- A public proof of concept is likely but unverified.
Our recommendation
- Inventory whether any product or service in use embeds libriscv, including builds from source.
- Upgrade libriscv to version 1.18 or later.
- Until the upgrade is applied, do not pass untrusted ELF files to the emulator.
- Re-assess the priority if memory disclosure is confirmed or exploitation is reported.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (1 repositories)
0Linear/CVE-2026-62958
Research sources
- GitHub Security Advisory GHSA-gm4g-6c78-gr3w github.com
- libriscv release v1.18 github.com
- Fix commit 61ef9ca (ELF loader overflow) github.com
- Fix commit 7bd1c18 (file-relative ELF access validation) github.com
- Positive Technologies PT-2026-134209 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:33.
Original description (NVD)
libriscv is a RISC-V sandbox and emulator. Prior to 1.18, a crafted ELF binary can cause out-of-bounds reads in the host emulator. `Memory<W>::binary_loader` checks `PT_LOAD` program-header bounds, but `Memory<W>::serialize_execute_segment` trusts section-header `sh_offset` and `sh_size` when locating `.text` without verifying the file range against `m_binary.size()`; `Memory<W>::lookup()` has a similar section-table problem. Malformed `.text` or `.symtab` offsets can therefore bypass the program-header checks and point outside the binary buffer, crashing rvlinux. With suitable memory layout or integer overflow, out-of-buffer host heap memory may instead be mapped into the guest by `create_execute_segment()`, potentially exposing host memory. The reported reproducer demonstrates a host SIGSEGV, while memory disclosure through grooming is described as possible rather than demonstrated. This issue is fixed in version 1.18.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.