NEMU (OpenXiangShan/NEMU) before release v2025.12.r2 contains an improper instruction‑validation flaw in its RISC‑V Vector (RVV) decoder. The decoder fails to validate the funct3 field when decoding the vsetvli/vsetivli/vsetvl instructions, allowing certain malformed OP‑V instruction encodings to be interpreted as vset* configuration instructions instead of raising an illegal‑instruction exception. This misinterpretation permits the execution of unintended vector setting code, which can corrupt architectural state, trigger incorrect trap handling and lead to a crash or denial of service.

The vulnerability affects NEMU (OpenXiangShan/NEMU) versions older than v2025.12.r2. No vendor identification beyond the NEMU project is available, and the flaw applies to all installations of the affected emulator that use the RVV decoder.

The CVSS score of 7.5 and an EPSS score of <1% indicate noteworthy severity but low probability of exploitation; the vulnerability is not listed in CISA KEV. Nevertheless, the flaw allows a maliciously crafted RISC‑V binary to be supplied to NEMU, which can then be executed and cause state corruption or a denial of service. The attack vector is likely local exploitation via controlled input to NEMU, but systems that expose NEMU as a service could be vulnerable to remote abuse. Given the potential for complete loss of emulator reliability, the risk is considered high, and prompt remediation is advised.