In OpenXiangShan NEMU, enabling Smstateen allows less‑privileged code to read or write the henvcfg and senvcfg CSRs because clearing mstateen0.ENVCFG does not enforce the expected exception. This bypasses isolation controls in virtualized or multi‑privilege environments, giving attackers elevated privileges over sensitive state registers.

OpenXiangShan NEMU is affected. No version information is specified.

The vulnerability is a privilege escalation flaw exposing privileged CSRs to code that should be denied. The EPSS score is not available and the vulnerability is not listed in CISA KEV, but because it enables unauthorized register access, any user with a lower privilege level in the virtual machine could exploit it. The attack vector appears to be local within the emulated environment, but could be leveraged by an attacker who can inject code into the NEMU instance. No CVSS score is provided.