This issue arises from an incorrect privilege assignment in the BOOM v3 and v4 NBDTLB implementations. The raw mstatus.SUM field can influence both read and write permission logic without an explicit local satp.MODE validity check. Because the mode of the SATP register is not verified, the system may incorrectly grant access rights, effectively allowing an attacker to elevate privileges within the simulator environment. The weakness is a direct consequence of improper privilege management and can compromise the integrity and confidentiality of the simulated processor state.

The root of the problem resides in the Berkeley Out-of-Order Machine (BOOM) open‑source project, specifically in commit 5223e44cfeb26f41380057a2eb4d651197475f69. Vulnerable components include the NBDTLB logic for both BOOM v3 and v4. No commercial vendor was identified in this data set, but anyone deploying or extending BOOM with these versions should review the affected code.

The CVSS score is 7.8, and EPSS remains <1%, so the overall quantified risk shows a high severity risk but a low exploitation probability. The vulnerability is not listed in the KEV catalog, implying no known widespread exploitation as of now. Nonetheless, the lack of a satp.MODE check means a local attacker who can influence the mstatus.SUM value may be able to manipulate permission checks in a way that grants unauthorized access. Based on the description it is inferred that the likely attack vector is a local context where the attacker can modify the status register or inject crafted instructions into BOOM. The associated CWE is CWE-266.