The vulnerability resides in the XiangShan open‑source RISC‑V processor. An improper gating of the distributed CSR write‑enable path allows illegal write attempts to alter the Physical Memory Attribute (PMA) CSR state. The RISC‑V privileged specification requires an illegal‑instruction exception when a non‑existent or illegal CSR is accessed, but affected XiangShan versions propagate these writes to replicated PMA configuration. The ability to tamper with memory‑attribute enforcement can lead to privilege escalation, information disclosure, or denial of service, depending on how PMAs enforce platform security and isolation boundaries.

Affected hosts are all systems that implement the XiangShan processor and rely on its default PMA configuration. Versions containing the commit edb1dfaf7d290ae99724594507dc46c2c2125384 are impacted; newer releases that incorporate the fix are not affected. No other vendors are implicated.

The CVSS score of 5.3 indicates moderate severity. EPSS is not available and the vulnerability is not listed in KEV. The attack vector is local – an attacker must already have the ability to execute code on the core. Based on the description, it is inferred that the attacker can write to privileged CSRs that control memory attributes, thereby manipulating PMA settings. This can undermine isolation guarantees and elevate privileges, with the exact impact depending on the platform’s security configuration.