The vulnerability resides in the CSR trap‑return state restoration logic of the BOOM RISC‑V processor. An attacker can craft input that causes MRET handling to mis‑update the mstatus.MPRV register and CSRFile states, enabling arbitrary machine‑mode instructions to run. This allows full compromise of the processor platform by executing code with machine‑level privileges.

It affects cases that use the BOOM Out‑of‑Order Machine (BOOM) / BoomTile RTL benchmark v1.2 at revision 2d08d0d8b4563212175212f9db0e69f6e68c9619, which is employed by projects such as ProcessorFuzz Benchmarks/Verilog/SmallBoomTile_v1.2_state.v. Systems that instantiate this RTL design, including custom SoCs or simulators running that benchmark, are vulnerable. No official patch is available yet from the vendor list, and affected parties should check for updates from the BOOM RISC‑V community.

Because the flaw permits arbitrary code execution at the highest privilege level, the potential damage is severe, potentially enabling complete takeover of the host system. No published CVSS score is provided, but the seriousness of the vulnerability is implied by an ability to bypass processor privilege checks. With the absence of EPSS, exploitation likelihood is uncertain but cannot be ruled out, and the vulnerability is not yet listed in the CISA KEV catalog. Attackers would need to deliver malformed CSR values or trigger a state restoration path, which could be achievable via remote interaction with any system that exposes the boot‑loader or firmware interface to insufficiently trusted input.