The vulnerability in NEMU's RISC-V Vector decoder involves improper validation of the funct3 field when decoding vector configuration instructions (vsetvli, vsetivli, vsetvl). Invalid OP-V instruction encodings can bypass expected checks and be executed as valid vector configuration instructions. This results in incorrect trap handling and architectural state corruption, which may cause denial of service in affected systems. The issue affects versions prior to v2025.12.r2. There is no vendor advisory or patch information available at this time.

The vulnerability does not impact confidentiality or integrity directly but can cause denial of service through architectural state corruption or divergence and incorrect trap behavior. Systems that depend on NEMU for accurate execution or sandboxing may experience failures or instability due to this flaw. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when running untrusted RISC-V binaries in environments relying on affected NEMU versions. Monitor vendor channels for updates and apply patches once released.