This vulnerability stems from an insufficient enforcement of Smstateen permission checks in OpenXiangShan NEMU. When the mstateen0.IMSIC bit is cleared, lower‑privileged code can still read the IMSIC state through the stopei and vstopei CSRs, enabling an attacker to gather information about other contexts’ interrupt states or to interfere with interrupt handling, thereby compromising both confidentiality and availability.

OpenXiangShan NEMU emulates RISC‑V ISA and implements the Smstateen mechanism to guard access to privileged CSRs. The flaw exists in any NEMU build that uses the described SMstateen check without the fix; no version range is specified in the CNA data, so all current releases that implement the unpatched logic are potentially affected.

The CVSS score is 6.5, reflecting moderate severity. The EPSS score is less than 1%, indicating a low probability of exploitation. Because the flaw requires an attacker to run low‑privileged code that can access the stopei/vstopei CSRs, it is typically a local privilege escalation scenario. When leveraged, the vulnerability can leak cross‑context interrupt state information or disrupt interrupt handling, compromising confidentiality and availability in multi‑context emulator environments. The vulnerability is not listed in CISA’s KEV catalog, suggesting no confirmed exploitation yet, but the potential impact warrants careful mitigation.