CVE-2026-71694

Published: Aug 19, 2026Modified: Sep 9, 2026Deferred

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

An issue in Berkeley Out-of-Order Machine (BOOM) / BoomTile RTL benchmark v1.2 2d08d0d8b4563212175212f9db0e69f6e68c9619 allows a remote attacker to execute arbitrary code via the CSR trap-return state restoration logic, MRET handling logic, mstatus.MPRV update path, CSRFile logic in ProcessorFuzz BOOM benchmark Benchmarks/Verilog/SmallBoomTile_v1.2_state.v

Related CWEs

CWE-352

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (4)

https://github.com/bu-icsg/ProcessorFuzz

Source: cve@mitre.org

https://github.com/duan528/BOOM-MRET-MPRV-Vulnerability-Report

Source: cve@mitre.org

https://github.com/riscv-boom/riscv-boom

Source: cve@mitre.org

https://github.com/riscv/riscv-isa-manual

Source: cve@mitre.org

Timeline

No history available yet.