CVE-2026-71694

{
  "id": "CVE-2026-71694",
  "sourceIdentifier": "[email protected]",
  "published": "2026-08-19T14:17:39.333",
  "lastModified": "2026-11-09T20:10:00.200",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "An issue in Berkeley Out-of-Order Machine (BOOM) / BoomTile RTL benchmark v1.2 2d08d0d8b4563212175212f9db0e69f6e68c9619 allows a remote attacker to execute arbitrary code via the CSR trap-return state restoration logic, MRET handling logic, mstatus.MPRV update path, CSRFile logic in ProcessorFuzz BOOM benchmark Benchmarks/Verilog/SmallBoomTile_v1.2_state.v"
    },
    {
      "lang": "es",
      "value": "Un problema en el benchmark RTL Berkeley Out-of-Order Machine (BOOM) / BoomTile v1.2 2d08d0d8b4563212175212f9db0e69f6e68c9619 permite a un atacante remoto ejecutar código arbitrario a través de la lógica de restauración de estado de retorno de trampa CSR, la lógica de manejo de MRET, la ruta de actualización de mstatus.MPRV, la lógica de CSRFile en el benchmark BOOM de ProcessorFuzz Benchmarks/Verilog/SmallBoomTile_v1.2_state.v"
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "version": "n/a",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-08-24T19:55:20.800140Z",
          "id": "CVE-2026-71694",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/bu-icsg/ProcessorFuzz",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/duan528/BOOM-MRET-MPRV-Vulnerability-Report",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/riscv-boom/riscv-boom",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/riscv/riscv-isa-manual",
      "source": "[email protected]"
    }
  ]
}