The vulnerability in OpenXiangShan NEMU occurs when a guest running in VS-mode writes to the supervisor interrupt‑enable CSR (sie) while the hypervisor extension (RVH) is enabled. The write is handled incorrectly and can modify the machine‑level interrupt enable register (mie). This flaw breaks the isolation between privilege layers and can let a guest influence host‑level interrupt handling. The result can be a denial of service or a breach of the privilege boundary expected by virtualization environments. The weakness is an improper enforcement of privilege boundaries, corresponding to access‑control failures.

Affected systems are installations of OpenXiangShan NEMU built before the commit 55295c4. Any emulator run with RVH (hypervisor extension) enabled and that has not applied the patch from pull request 938 is vulnerable. No specific vendor or product list is provided beyond the NEMU emulator.

The EPSS score for this issue is not available and it is not listed in the CISA KEV catalog, indicating no known public exploits. The vulnerability is most likely exploitable only inside the emulator, requiring local control of a guest operating system and the ability to issue writes to sie. Because the flaw allows a guest to change host interrupt state, the potential impact is significant in environments where NEMU is used for isolation or virtual‑machine hosting. Without a public exploit and given the limited attack surface, the overall risk is moderate to high for environments that rely on NEMU for trusted virtualization.