Threats affecting pkg:github/libriscv/libriscv

CVE-2026-62958 is a high-severity vulnerability in libriscv, a RISC-V sandbox and emulator, affecting versions prior to 1.18. It involves improper input validation of ELF binaries, where crafted binaries can cause out-of-bounds reads in the host emulator. This occurs because certain section-header offsets are not properly verified against the binary size, allowing access outside the intended memory buffer. The flaw can lead to host crashes (SIGSEGV) and potentially expose host memory to the guest environment. The issue is fixed in libriscv version 1.18.