CVE-2021-40507

9.8 criticalEPSS 0.7%

Critical (9.8) in openrisc or1200 firmware. EPSS 0.7% chance of exploitation in the next 30 days.

An issue was discovered in the ALU unit of the OR1200 (aka OpenRISC 1200) processor 2011-09-10 through 2015-11-11. The overflow flag is not being updated correctly for the subtract instruction, which results in an incorrect value in the overflow flag. Any software that relies on this flag may experience corruption in execution.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.7% chance of exploitation in the next 30 days; higher than 54% of CVEs (scores of 2026-10-31)
CWE: CWE-287
Published: 2023-04-18
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

openrisc:or1200_firmware

References

https://github.com/openrisc/or1200/commit/2c0765d7ba12813df273cd693a99c4e744f0fbd5
https://seth.engr.tamu.edu/software-releases/thehuzz/
https://github.com/openrisc/or1200/commit/2c0765d7ba12813df273cd693a99c4e744f0fbd5
https://seth.engr.tamu.edu/software-releases/thehuzz/

Check your stack JSON