CVE-2026-67846CWE-266

CVE-2026-67846

High · published August 18, 2026

CVSS v3.1
7.8
EPSS
0%
Percentile
4.2
In the wild
Unconfirmed
What it is

Berkeley Out-of-Order Machine (BOOM) commit 5223e44cfeb26f41380057a2eb4d651197475f69 contains a potential incorrect privilege assignment issue in the v3 and v4 NBDTLB implementations. The raw mstatus.SUM value participates in the read and write permission logic without an explicit local satp.MODE validity check at the use site

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00155 · 4.2th percentile
Weakness
CWE-266 · Incorrect Privilege Assignment
Published
2026-08-18T22:19Z
References (3)
https://github.com/duan528/CVE-2026-67846-BOOM-NBDTLB · [email protected]https://github.com/riscv-boom/riscv-boom · [email protected]https://github.com/riscv-boom/riscv-boom/commit/5223e44cfeb26f41380057a2eb4d651197475f69 · [email protected]
EPSS history
Timeline
  • 18 AUG 00:00Z
    Berkeley Out-of-Order Machine (BOOM) commit 5223e44cfeb26f41380057a2eb4d651197475f69 contains a potential incorrect privilege assignment issue in the v3 and v4…
    cvelistv5