The vulnerability in OpenXiangShan NEMU occurs when a guest operating system running in VS‑mode writes to the supervisor interrupt‑enable CSR (sie) while the hypervisor extension (RVH) is enabled. The write is handled incorrectly and can modify the machine‑level interrupt enable register (mie), breaking the isolation between privilege layers. An attacker who can control a guest can therefore influence host interrupt handling, potentially leading to a denial of service or to a breach of the privileged boundary. The flaw is an improper enforcement of privilege boundaries (CWE‑267).

All OpenXiangShan NEMU builds executed before commit 55295c4 and run with RVH enabled are vulnerable. The issue exists on any installation that has not incorporated the patch from pull request 938. No other vendor or product variants are identified.

The CVSS score of 9.8 indicates a high severity threat. The EPSS score of less than 1% and the absence from the CISA KEV catalog suggest that public exploitation is unlikely at present, but the vulnerability, associated with CWE‑267, remains actionable in environments that rely on NEMU for isolation. Exploitation requires local control of a VS‑mode guest, so the attack surface is limited to systems that host NEMU. Because the impact can cause a denial of service or privilege escalation, the overall risk is moderate to high for those systems.