The vulnerability in NEMU's RISC-V Vector (RVV) decoder arises from improper validation of the funct3 field during decoding of vsetvli, vsetivli, and vsetvl instructions. Invalid OP-V instruction encodings can bypass expected validation and be executed as legitimate vector configuration instructions. This flaw can be triggered by supplying crafted RISC-V binaries, causing the emulator to misinterpret instructions, resulting in incorrect trap handling, corruption or divergence of architectural state, and denial of service conditions. The issue affects NEMU versions prior to v2025.12.r2. No CVSS score or remediation details are currently provided.

Successful exploitation can cause incorrect trap behavior and corruption or divergence of the architectural state within NEMU, potentially leading to denial of service in environments that depend on NEMU for accurate execution or sandboxing. There is no evidence of known exploits in the wild. The impact is primarily on the integrity and reliability of systems using affected NEMU versions for RISC-V vector instruction emulation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor for updates from the NEMU project or OpenXiangShan maintainers. Until a fix is available, avoid running untrusted RISC-V binaries that could exploit this instruction-validation flaw in affected NEMU versions.