CVE-2026-71694CWE-352csrf

CVE-2026-71694

High · published August 19, 2026

CVSS v3.1
8.8
EPSS
0%
Percentile
31.0
In the wild
Unconfirmed
What it is

An issue in Berkeley Out-of-Order Machine (BOOM) / BoomTile RTL benchmark v1.2 2d08d0d8b4563212175212f9db0e69f6e68c9619 allows a remote attacker to execute arbitrary code via the CSR trap-return state restoration logic, MRET handling logic, mstatus.MPRV update path, CSRFile logic in ProcessorFuzz BOOM benchmark Benchmarks/Verilog/SmallBoomTile_v1.2_state.v

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00382 · 31.0th percentile
Weakness
CWE-352 · Cross-Site Request Forgery (CSRF)
Published
2026-08-19T18:17Z
References (4)
https://github.com/bu-icsg/ProcessorFuzz · [email protected]https://github.com/duan528/BOOM-MRET-MPRV-Vulnerability-Report · [email protected]https://github.com/riscv-boom/riscv-boom · [email protected]https://github.com/riscv/riscv-isa-manual · [email protected]
EPSS history
Timeline
  • 19 AUG 00:00Z
    An issue in Berkeley Out-of-Order Machine (BOOM) / BoomTile RTL benchmark v1.2 2d08d0d8b4563212175212f9db0e69f6e68c9619 allows a remote attacker to execute…
    cvelistv5