Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
163 vulnerabilities
CVE-2026-62434 (GCVE-0-2026-62434)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:33 – Updated: 2026-07-28 16:33
VLAI
EPSS
VEX
Title
PoD: Don't try to reclaim special pages
Summary
A guest started with Populated on Demand enabled (PoD) can attempt to
reclaim pages which aren't regular guest RAM. This can cause corruption
of memory management state in Xen.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-787 - Out-of-bounds Write
Assigner
References
Date Public
2026-07-28 12:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-28T16:33:34.668Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://xenbits.xen.org/xsa/advisory-507.html"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/28/23"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-62434",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T14:59:52.970334Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-787",
"description": "CWE-787 Out-of-bounds Write",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:00:00.728Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-507"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from 3.4 onwards are vulnerable. Xen versions 3.3 and\nearlier are not vulnerable.\n\nOnly x86 systems are vulnerable.\n\nOnly x86 HVM and PVH guests started in populate-on-demand mode are\nbelieved to be able to leverage the vulnerability. Populate-on-demand\nmode is activated when the guest\u0027s xl configuration file specifies a\n\"maxmem\" value which is larger than the \"memory\" value."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "A guest started with Populated on Demand enabled (PoD) can attempt to\nreclaim pages which aren\u0027t regular guest RAM. This can cause corruption\nof memory management state in Xen."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "A buggy or malicious guest can cause corruption of Xen\u0027s state, leading\nto crashes or other malfunctions. Information leak and privilege\nescalation cannot be ruled out."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:33:08.540Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-507.html"
}
],
"title": "PoD: Don\u0027t try to reclaim special pages",
"workarounds": [
{
"lang": "en",
"value": "Running only PV guests or HVM/PVH guests without PoD will avoid the\nvulnerability."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-62434",
"datePublished": "2026-07-28T12:33:08.540Z",
"dateReserved": "2026-07-14T10:28:12.655Z",
"dateUpdated": "2026-07-28T16:33:34.668Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62433 (GCVE-0-2026-62433)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:32 – Updated: 2026-07-28 16:33
VLAI
EPSS
VEX
Title
correct buffer checks for DM_OP hypercalls
Summary
Parts of the DM_OP handling code assumes the caller has provided the
required number of buffers for the given operation without any checking
being done. As a result, certain operations might access stack
rubble as structures are possibly uninitialized.
Severity
7.3 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-665 - Improper Initialization
Assigner
References
Date Public
2026-07-28 12:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-28T16:33:33.573Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://xenbits.xen.org/xsa/advisory-506.html"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/28/22"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-62433",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T15:03:57.527525Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-665",
"description": "CWE-665 Improper Initialization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:06:29.391Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-506"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from 4.10 onwards are vulnerable. Xen versions 4.9 and\nearlier are not vulnerable.\n\nOnly entities controlling HVM guests can leverage the vulnerability.\nThese are device models running in either a stub domain or de-privileged\nin Dom0."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Parts of the DM_OP handling code assumes the caller has provided the\nrequired number of buffers for the given operation without any checking\nbeing done. As a result, certain operations might access stack\nrubble as structures are possibly uninitialized."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "A device model of a HVM guest can gain insight on the contents of the\nXen stack, thus possibly leaking data from other guests contexts."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:32:59.802Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-506.html"
}
],
"title": "correct buffer checks for DM_OP hypercalls",
"workarounds": [
{
"lang": "en",
"value": "Running only PV or PVH guests will avoid the vulnerability.\n\n(Switching from a device model stub domain or a de-privileged device\nmodel to a fully privileged Dom0 device model does NOT mitigate this\nvulnerability. Rather, it simply recategorises the vulnerability to\nhostile management code, regarding it \"as designed\"; thus it merely\nreclassifies these issues as \"not a bug\". The security of a Xen system\nusing stub domains is still better than with a qemu-dm running as a Dom0\nprocess. Users and vendors of stub qemu dm systems should not change\ntheir configuration to use a Dom0 QEMU process.)"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-62433",
"datePublished": "2026-07-28T12:32:59.802Z",
"dateReserved": "2026-07-14T10:28:12.655Z",
"dateUpdated": "2026-07-28T16:33:33.573Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62432 (GCVE-0-2026-62432)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:32 – Updated: 2026-07-28 16:33
VLAI
EPSS
VEX
Title
evtchn: Race between FIFO expand and reset
Summary
The EVTCHNOP_expand_array hypercall checks for whether FIFO event
channels are enabled, but without holding the correct lock. It can race
with EVTCHNOP_reset, resulting in dereferencing a NULL pointer.
Severity
7.3 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
Date Public
2026-07-28 12:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-28T16:33:32.509Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://xenbits.xen.org/xsa/advisory-505.html"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/28/21"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-62432",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T15:13:34.638706Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:13:39.575Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-505"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from 4.5 onwards are vulnerable. Xen versions 4.4 and\nearlier are not vulnerable."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The EVTCHNOP_expand_array hypercall checks for whether FIFO event\nchannels are enabled, but without holding the correct lock. It can race\nwith EVTCHNOP_reset, resulting in dereferencing a NULL pointer."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "A malicious HVM guest (x86 HVM or PVH, and ARM) can crash Xen leading to\na denial of service.\n\nA malicious x86 PV guest can most likely crash Xen leading to a denial\nof service, but memory corruption or privilege escalation cannot be\nruled out."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:32:52.043Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-505.html"
}
],
"title": "evtchn: Race between FIFO expand and reset",
"workarounds": [
{
"lang": "en",
"value": "There are no mitigations."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-62432",
"datePublished": "2026-07-28T12:32:52.043Z",
"dateReserved": "2026-07-14T10:28:12.655Z",
"dateUpdated": "2026-07-28T16:33:32.509Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62431 (GCVE-0-2026-62431)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:32 – Updated: 2026-07-28 16:33
VLAI
EPSS
VEX
Title
Viridian STIMER division by zero
Summary
The logic to handle periodic Viridian STIMERs performs a division with an
unchecked user-controlled divisor value, that can be set to zero to cause a #DE
fault.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-369 - Divide By Zero
Assigner
References
Date Public
2026-07-28 12:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-28T16:33:31.447Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://xenbits.xen.org/xsa/advisory-504.html"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/28/20"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-62431",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T15:49:03.810668Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-369",
"description": "CWE-369 Divide By Zero",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:49:09.743Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-504"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from 4.13 onwards are vulnerable. Xen versions 4.12 and\nearlier are not vulnerable.\n\nOnly HVM guests with Viridian STIMERs enabled can trigger the vulnerability."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The logic to handle periodic Viridian STIMERs performs a division with an\nunchecked user-controlled divisor value, that can be set to zero to cause a #DE\nfault."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Enabling Viridian STIMERs to unprivileged HVM guests can result in a Denial\nof Service (DoS) affecting the entire host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:32:43.849Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-504.html"
}
],
"title": "Viridian STIMER division by zero",
"workarounds": [
{
"lang": "en",
"value": "Not enabling Viridian STIMERs for HVM guests will avoid the vulnerability.\n\nNote Viridian extensions are not enabled by default."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-62431",
"datePublished": "2026-07-28T12:32:43.849Z",
"dateReserved": "2026-07-14T10:28:12.655Z",
"dateUpdated": "2026-07-28T16:33:31.447Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62430 (GCVE-0-2026-62430)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:32 – Updated: 2026-07-28 16:33
VLAI
EPSS
VEX
Title
x86: Out-of-bounds read in vRTC emulation
Summary
Accesses to the CMOS memory contents are done using an indirect IO port
pair. Therefore Xen needs to cache the guest chosen index, and one of
the usages of the index didn't take the necessary locking to avoid
concurrent changes. As a result, a guest could change the index after
it being checked, causing a subsequent out-of-bound read access to the
contents of an array.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
Date Public
2026-07-28 12:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-28T16:33:30.367Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://xenbits.xen.org/xsa/advisory-503.html"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/28/19"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-62430",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T15:50:31.706627Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:50:36.149Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-503"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from 3.2 onwards are vulnerable. Xen versions 3.1 and\nearlier are not vulnerable."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Accesses to the CMOS memory contents are done using an indirect IO port\npair. Therefore Xen needs to cache the guest chosen index, and one of\nthe usages of the index didn\u0027t take the necessary locking to avoid\nconcurrent changes. As a result, a guest could change the index after\nit being checked, causing a subsequent out-of-bound read access to the\ncontents of an array."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "An attacker can read out-of-bounds, this is limited to Xen data, and not\ndata belonging to other guests."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:32:33.150Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-503.html"
}
],
"title": "x86: Out-of-bounds read in vRTC emulation",
"workarounds": [
{
"lang": "en",
"value": "Running only PV or PVH guests will avoid the vulnerability."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-62430",
"datePublished": "2026-07-28T12:32:33.150Z",
"dateReserved": "2026-07-14T10:28:12.655Z",
"dateUpdated": "2026-07-28T16:33:30.367Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62429 (GCVE-0-2026-62429)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:32 – Updated: 2026-07-28 16:33
VLAI
EPSS
VEX
Title
vNUMA domain cleanup may race other operations
Summary
Accessing the vNUMA configuration data of a guest is still possible when
domain destruction has already started. The cleaning up of that
configuration information is not synchronized with its retrieval by a
device model controlling the guest.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
Date Public
2026-07-28 12:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-28T16:33:29.286Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://xenbits.xen.org/xsa/advisory-502.html"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/28/18"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-62429",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T14:56:13.716116Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:51:45.362Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-502"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from 4.5 onwards are vulnerable. Xen versions 4.4 and\nearlier are not vulnerable.\n\nOnly entities controlling guests (on x86: HVM guests) can leverage the\nvulnerability. These are device models running in either a stub domain or\nde-privileged in Dom0.\n\nOnly guests which have vNUMA enabled allow their controlling entities to\nleverage the vulnerability."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Teddy Astie of Vates."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Accessing the vNUMA configuration data of a guest is still possible when\ndomain destruction has already started. The cleaning up of that\nconfiguration information is not synchronized with its retrieval by a\ndevice model controlling the guest."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "While Denial of Service (DoS) affecting the entire host and information\nleaks and are the prevailing effect, a device model stub domain or a\nde-privileged device model running in the control domain may also be\nable to elevate its privileges to that of the host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:32:24.333Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-502.html"
}
],
"title": "vNUMA domain cleanup may race other operations",
"workarounds": [
{
"lang": "en",
"value": "On x86, running only PV or PVH guests will avoid the vulnerability.\n\nNot enabling vNUMA for HVM guests will also avoid the vulnerability."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-62429",
"datePublished": "2026-07-28T12:32:24.333Z",
"dateReserved": "2026-07-14T10:28:12.655Z",
"dateUpdated": "2026-07-28T16:33:29.286Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62436 (GCVE-0-2026-62436)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:32 – Updated: 2026-07-28 15:17
VLAI
EPSS
VEX
Title
grant-table: version change racing with other operations
Summary
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
With the introduction of Grant Table v2 came the requirement to be able to
switch between versions. Switching from v1 to v2 reduces the number of
valid grant references, as a bigger shared entry structure is then needed
while the shared table doesn't change size. Switching from v2 back to v1
the status frames, which are separate in v2, go away.
Code holding, but intermediately dropping and then re-acquiring the grant
table lock, sometimes wrongly assumes that said properties wouldn't change
across the window in time where the lock is not being held.
The v1 -> v2 issue is CVE-2026-62435.
The v2 -> v1 issue is CVE-2026-62436.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
1 reference
Date Public
2026-07-28 12:00
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-62436",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T15:16:28.153900Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:17:33.705Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-501"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from 4.0 onwards are vulnerable. Xen versions 3.4 and\nearlier are not vulnerable.\n\nOnly x86 guests permitted to use grant table version 2 interfaces can\nleverage this vulnerability. On Arm, grant table v2 use is explicitly\nunsupported.\n\nOnly multi-vCPU guests can leverage this vulnerability.\n\nXen versions 4.13 and newer offer a way to build Xen without grant table\nsupport. Such hypervisors (CONFIG_GRANT_TABLE turned off) are not\nvulnerable."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Mark Esler."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nWith the introduction of Grant Table v2 came the requirement to be able to\nswitch between versions. Switching from v1 to v2 reduces the number of\nvalid grant references, as a bigger shared entry structure is then needed\nwhile the shared table doesn\u0027t change size. Switching from v2 back to v1\nthe status frames, which are separate in v2, go away.\n\nCode holding, but intermediately dropping and then re-acquiring the grant\ntable lock, sometimes wrongly assumes that said properties wouldn\u0027t change\nacross the window in time where the lock is not being held.\n\nThe v1 -\u003e v2 issue is CVE-2026-62435.\n\nThe v2 -\u003e v1 issue is CVE-2026-62436."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "An unprivileged guest may be able to elevate its privileges to that of the\nhost. Information leaks and Denial of Service (DoS) are possible as well."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:32:16.344Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-501.html"
}
],
"title": "grant-table: version change racing with other operations",
"workarounds": [
{
"lang": "en",
"value": "Using the \"gnttab=max-ver:1\" hypervisor command line option will avoid\nthe vulnerability.\n\nUsing the \"max_grant_version=1\" guest configuration option for guests will\nalso avoid the vulnerability."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-62436",
"datePublished": "2026-07-28T12:32:16.344Z",
"dateReserved": "2026-07-14T10:28:12.655Z",
"dateUpdated": "2026-07-28T15:17:33.705Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62435 (GCVE-0-2026-62435)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:32 – Updated: 2026-07-28 15:19
VLAI
EPSS
VEX
Title
grant-table: version change racing with other operations
Summary
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
With the introduction of Grant Table v2 came the requirement to be able to
switch between versions. Switching from v1 to v2 reduces the number of
valid grant references, as a bigger shared entry structure is then needed
while the shared table doesn't change size. Switching from v2 back to v1
the status frames, which are separate in v2, go away.
Code holding, but intermediately dropping and then re-acquiring the grant
table lock, sometimes wrongly assumes that said properties wouldn't change
across the window in time where the lock is not being held.
The v1 -> v2 issue is CVE-2026-62435.
The v2 -> v1 issue is CVE-2026-62436.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Assigner
References
1 reference
Date Public
2026-07-28 12:00
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-62435",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T15:19:26.810813Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:19:30.368Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-501"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from 4.0 onwards are vulnerable. Xen versions 3.4 and\nearlier are not vulnerable.\n\nOnly x86 guests permitted to use grant table version 2 interfaces can\nleverage this vulnerability. On Arm, grant table v2 use is explicitly\nunsupported.\n\nOnly multi-vCPU guests can leverage this vulnerability.\n\nXen versions 4.13 and newer offer a way to build Xen without grant table\nsupport. Such hypervisors (CONFIG_GRANT_TABLE turned off) are not\nvulnerable."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Mark Esler."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nWith the introduction of Grant Table v2 came the requirement to be able to\nswitch between versions. Switching from v1 to v2 reduces the number of\nvalid grant references, as a bigger shared entry structure is then needed\nwhile the shared table doesn\u0027t change size. Switching from v2 back to v1\nthe status frames, which are separate in v2, go away.\n\nCode holding, but intermediately dropping and then re-acquiring the grant\ntable lock, sometimes wrongly assumes that said properties wouldn\u0027t change\nacross the window in time where the lock is not being held.\n\nThe v1 -\u003e v2 issue is CVE-2026-62435.\n\nThe v2 -\u003e v1 issue is CVE-2026-62436."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "An unprivileged guest may be able to elevate its privileges to that of the\nhost. Information leaks and Denial of Service (DoS) are possible as well."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:32:16.287Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-501.html"
}
],
"title": "grant-table: version change racing with other operations",
"workarounds": [
{
"lang": "en",
"value": "Using the \"gnttab=max-ver:1\" hypervisor command line option will avoid\nthe vulnerability.\n\nUsing the \"max_grant_version=1\" guest configuration option for guests will\nalso avoid the vulnerability."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-62435",
"datePublished": "2026-07-28T12:32:16.287Z",
"dateReserved": "2026-07-14T10:28:12.655Z",
"dateUpdated": "2026-07-28T15:19:30.368Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62428 (GCVE-0-2026-62428)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:32 – Updated: 2026-07-28 16:33
VLAI
EPSS
VEX
Title
grant-table: type confusion in grant-copy
Summary
When grant-copy operations are processed, the respective grant may or may
not already be in use by another operation (a mapping or another copy).
For all copy operations the referenced guest frame is looked up. When
another operation is already active for the grant (the grant is "pinned"),
what is being supplied back to actually carry out permission checks and
copy operation may not be consistent: The permission check may be carried
out on a page different from the one involved in the copy.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
Assigner
References
Date Public
2026-07-28 12:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-28T16:33:28.183Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://xenbits.xen.org/xsa/advisory-500.html"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/28/16"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-62428",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T15:10:28.542416Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-367",
"description": "CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:10:53.004Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-500"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from 4.2 onwards are vulnerable. Xen versions 4.1 and\nearlier are not vulnerable.\n\nXen versions 4.13 and newer offer a way to build Xen without grant table\nsupport. Such hypervisors (CONFIG_GRANT_TABLE turned off) are not\nvulnerable."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Roman S."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "When grant-copy operations are processed, the respective grant may or may\nnot already be in use by another operation (a mapping or another copy).\nFor all copy operations the referenced guest frame is looked up. When\nanother operation is already active for the grant (the grant is \"pinned\"),\nwhat is being supplied back to actually carry out permission checks and\ncopy operation may not be consistent: The permission check may be carried\nout on a page different from the one involved in the copy."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "An unprivileged guest may be able to elevate its privileges to that of the\nhost. Information leaks and Denial of Service (DoS) are possible as well."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:32:07.573Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-500.html"
}
],
"title": "grant-table: type confusion in grant-copy",
"workarounds": [
{
"lang": "en",
"value": "There is no known mitigation."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-62428",
"datePublished": "2026-07-28T12:32:07.573Z",
"dateReserved": "2026-07-14T10:28:12.655Z",
"dateUpdated": "2026-07-28T16:33:28.183Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62427 (GCVE-0-2026-62427)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:31 – Updated: 2026-07-28 15:54
VLAI
EPSS
VEX
Title
sysctl and platform-op locks open to abuse
Summary
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
To manage the system, sysctl and platform operations are used by the
control domain or a possible Xenstore domain. Some of these operations
may not be executed in parallel, so a system-wide lock each is used.
The way those locks are acquired is, however, not providing any fairness.
Furthermore, with XSM/Flask in use, the lock acquire will, for some
operations, occur ahead of any permission checking.
The sysctl issue is CVE-2026-62426.
The platform-op issue is CVE-2026-62427.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
Assigner
References
1 reference
Date Public
2026-07-28 12:00
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-62427",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T15:54:13.421567Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-305",
"description": "CWE-305 Authentication Bypass by Primary Weakness",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:54:19.508Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-499"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from 4.0 onwards are vulnerable. Earlier versions use\na different locking operation, but may also be vulnerable."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Jan Beulich of SUSE."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nTo manage the system, sysctl and platform operations are used by the\ncontrol domain or a possible Xenstore domain. Some of these operations\nmay not be executed in parallel, so a system-wide lock each is used.\nThe way those locks are acquired is, however, not providing any fairness.\nFurthermore, with XSM/Flask in use, the lock acquire will, for some\noperations, occur ahead of any permission checking.\n\nThe sysctl issue is CVE-2026-62426.\n\nThe platform-op issue is CVE-2026-62427."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "A less privileged entity may stall an equally or more privileged entity,\npotentially leading to a Denial od Service (DoS) of up to the entire\nhost."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:31:57.645Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-499.html"
}
],
"title": "sysctl and platform-op locks open to abuse",
"workarounds": [
{
"lang": "en",
"value": "There is no known mitigation."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-62427",
"datePublished": "2026-07-28T12:31:57.645Z",
"dateReserved": "2026-07-14T10:28:12.655Z",
"dateUpdated": "2026-07-28T15:54:19.508Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62426 (GCVE-0-2026-62426)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:31 – Updated: 2026-07-28 15:55
VLAI
EPSS
VEX
Title
sysctl and platform-op locks open to abuse
Summary
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
To manage the system, sysctl and platform operations are used by the
control domain or a possible Xenstore domain. Some of these operations
may not be executed in parallel, so a system-wide lock each is used.
The way those locks are acquired is, however, not providing any fairness.
Furthermore, with XSM/Flask in use, the lock acquire will, for some
operations, occur ahead of any permission checking.
The sysctl issue is CVE-2026-62426.
The platform-op issue is CVE-2026-62427.
Severity
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
Assigner
References
1 reference
Date Public
2026-07-28 12:00
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-62426",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T15:55:06.523957Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-667",
"description": "CWE-667 Improper Locking",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-412",
"description": "CWE-412 Unrestricted Externally Accessible Lock",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:55:11.598Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-499"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from 4.0 onwards are vulnerable. Earlier versions use\na different locking operation, but may also be vulnerable."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Jan Beulich of SUSE."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nTo manage the system, sysctl and platform operations are used by the\ncontrol domain or a possible Xenstore domain. Some of these operations\nmay not be executed in parallel, so a system-wide lock each is used.\nThe way those locks are acquired is, however, not providing any fairness.\nFurthermore, with XSM/Flask in use, the lock acquire will, for some\noperations, occur ahead of any permission checking.\n\nThe sysctl issue is CVE-2026-62426.\n\nThe platform-op issue is CVE-2026-62427."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "A less privileged entity may stall an equally or more privileged entity,\npotentially leading to a Denial od Service (DoS) of up to the entire\nhost."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:31:57.586Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-499.html"
}
],
"title": "sysctl and platform-op locks open to abuse",
"workarounds": [
{
"lang": "en",
"value": "There is no known mitigation."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-62426",
"datePublished": "2026-07-28T12:31:57.586Z",
"dateReserved": "2026-07-14T10:28:12.655Z",
"dateUpdated": "2026-07-28T15:55:11.598Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62425 (GCVE-0-2026-62425)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:31 – Updated: 2026-07-28 15:40
VLAI
EPSS
VEX
Title
buffer overruns in libfsimage iso9660 handling
Summary
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver
derives several lengths directly from attacker-controlled on-disk fields
without validating them:
* The directory loop itself assumes a good record length. This is
CVE-2026-42494.
* The calculation of the System Use area may underflow. This is
CVE-2026-42495.
* The Rock Ridge extension loop assumes a good (inner) record length.
This is CVE-2026-62423.
* The Rock Ridge NM record processing assumes a good entry length.
This is CVE-2026-62424.
* The Rock Ridge CE record processing assumes a good size and offset.
This is CVE-2026-62425.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-20 - Improper Input Validation
Assigner
References
1 reference
Date Public
2026-07-28 12:00
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-62425",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T15:40:12.638109Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:40:37.904Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-497"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from at least 3.2 onwards are affected. Older versions\nhave not been inspected."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Syed Abdul Khaliq of BugQore."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nThe directory and Rock Ridge / SUSP walk in libfsimage\u0027s iso9660 driver\nderives several lengths directly from attacker-controlled on-disk fields\nwithout validating them:\n\n * The directory loop itself assumes a good record length. This is\n CVE-2026-42494.\n\n * The calculation of the System Use area may underflow. This is\n CVE-2026-42495.\n\n * The Rock Ridge extension loop assumes a good (inner) record length.\n This is CVE-2026-62423.\n\n * The Rock Ridge NM record processing assumes a good entry length.\n This is CVE-2026-62424.\n\n * The Rock Ridge CE record processing assumes a good size and offset.\n This is CVE-2026-62425."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "A guest using pygrub can escalate its privilege to that of the domain\nconstruction tools (i.e., normally, to control of the host).\n\nIf the mechanism introduced by XSA-443 (see the mitigation section below)\nis in use, then the guest can only escalate to this limited context."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:31:41.918Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-497.html"
}
],
"title": "buffer overruns in libfsimage iso9660 handling",
"workarounds": [
{
"lang": "en",
"value": "XSA-443 added a mechanism to run pygrub de-privileged. Using this mode\nwill mitigate the vulnerability.\n\nEnsuring that guests do not use the pygrub bootloader will avoid this\nvulnerability.\n\nFor cases where the PV guest is known to be 64bit, and uses grub2 as a\nbootloader, pvgrub is a suitable alternative to pygrub.\n\nRunning only HVM or PVH guests will avoid the vulnerability."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-62425",
"datePublished": "2026-07-28T12:31:41.918Z",
"dateReserved": "2026-07-14T10:28:12.654Z",
"dateUpdated": "2026-07-28T15:40:37.904Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62424 (GCVE-0-2026-62424)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:31 – Updated: 2026-07-28 14:53
VLAI
EPSS
VEX
Title
buffer overruns in libfsimage iso9660 handling
Summary
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver
derives several lengths directly from attacker-controlled on-disk fields
without validating them:
* The directory loop itself assumes a good record length. This is
CVE-2026-42494.
* The calculation of the System Use area may underflow. This is
CVE-2026-42495.
* The Rock Ridge extension loop assumes a good (inner) record length.
This is CVE-2026-62423.
* The Rock Ridge NM record processing assumes a good entry length.
This is CVE-2026-62424.
* The Rock Ridge CE record processing assumes a good size and offset.
This is CVE-2026-62425.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-130 - Improper Handling of Length Parameter Inconsistency
Assigner
References
1 reference
Date Public
2026-07-28 12:00
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-62424",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T14:53:03.759623Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-130",
"description": "CWE-130 Improper Handling of Length Parameter Inconsistency",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T14:53:51.529Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-497"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from at least 3.2 onwards are affected. Older versions\nhave not been inspected."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Syed Abdul Khaliq of BugQore."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nThe directory and Rock Ridge / SUSP walk in libfsimage\u0027s iso9660 driver\nderives several lengths directly from attacker-controlled on-disk fields\nwithout validating them:\n\n * The directory loop itself assumes a good record length. This is\n CVE-2026-42494.\n\n * The calculation of the System Use area may underflow. This is\n CVE-2026-42495.\n\n * The Rock Ridge extension loop assumes a good (inner) record length.\n This is CVE-2026-62423.\n\n * The Rock Ridge NM record processing assumes a good entry length.\n This is CVE-2026-62424.\n\n * The Rock Ridge CE record processing assumes a good size and offset.\n This is CVE-2026-62425."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "A guest using pygrub can escalate its privilege to that of the domain\nconstruction tools (i.e., normally, to control of the host).\n\nIf the mechanism introduced by XSA-443 (see the mitigation section below)\nis in use, then the guest can only escalate to this limited context."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:31:41.862Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-497.html"
}
],
"title": "buffer overruns in libfsimage iso9660 handling",
"workarounds": [
{
"lang": "en",
"value": "XSA-443 added a mechanism to run pygrub de-privileged. Using this mode\nwill mitigate the vulnerability.\n\nEnsuring that guests do not use the pygrub bootloader will avoid this\nvulnerability.\n\nFor cases where the PV guest is known to be 64bit, and uses grub2 as a\nbootloader, pvgrub is a suitable alternative to pygrub.\n\nRunning only HVM or PVH guests will avoid the vulnerability."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-62424",
"datePublished": "2026-07-28T12:31:41.862Z",
"dateReserved": "2026-07-14T10:28:12.654Z",
"dateUpdated": "2026-07-28T14:53:51.529Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-62423 (GCVE-0-2026-62423)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:31 – Updated: 2026-07-28 14:51
VLAI
EPSS
VEX
Title
buffer overruns in libfsimage iso9660 handling
Summary
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver
derives several lengths directly from attacker-controlled on-disk fields
without validating them:
* The directory loop itself assumes a good record length. This is
CVE-2026-42494.
* The calculation of the System Use area may underflow. This is
CVE-2026-42495.
* The Rock Ridge extension loop assumes a good (inner) record length.
This is CVE-2026-62423.
* The Rock Ridge NM record processing assumes a good entry length.
This is CVE-2026-62424.
* The Rock Ridge CE record processing assumes a good size and offset.
This is CVE-2026-62425.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-130 - Improper Handling of Length Parameter Inconsistency
Assigner
References
1 reference
Date Public
2026-07-28 12:00
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-62423",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T14:49:36.986097Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-130",
"description": "CWE-130 Improper Handling of Length Parameter Inconsistency",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T14:51:03.684Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-497"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from at least 3.2 onwards are affected. Older versions\nhave not been inspected."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Syed Abdul Khaliq of BugQore."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nThe directory and Rock Ridge / SUSP walk in libfsimage\u0027s iso9660 driver\nderives several lengths directly from attacker-controlled on-disk fields\nwithout validating them:\n\n * The directory loop itself assumes a good record length. This is\n CVE-2026-42494.\n\n * The calculation of the System Use area may underflow. This is\n CVE-2026-42495.\n\n * The Rock Ridge extension loop assumes a good (inner) record length.\n This is CVE-2026-62423.\n\n * The Rock Ridge NM record processing assumes a good entry length.\n This is CVE-2026-62424.\n\n * The Rock Ridge CE record processing assumes a good size and offset.\n This is CVE-2026-62425."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "A guest using pygrub can escalate its privilege to that of the domain\nconstruction tools (i.e., normally, to control of the host).\n\nIf the mechanism introduced by XSA-443 (see the mitigation section below)\nis in use, then the guest can only escalate to this limited context."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:31:41.801Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-497.html"
}
],
"title": "buffer overruns in libfsimage iso9660 handling",
"workarounds": [
{
"lang": "en",
"value": "XSA-443 added a mechanism to run pygrub de-privileged. Using this mode\nwill mitigate the vulnerability.\n\nEnsuring that guests do not use the pygrub bootloader will avoid this\nvulnerability.\n\nFor cases where the PV guest is known to be 64bit, and uses grub2 as a\nbootloader, pvgrub is a suitable alternative to pygrub.\n\nRunning only HVM or PVH guests will avoid the vulnerability."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-62423",
"datePublished": "2026-07-28T12:31:41.801Z",
"dateReserved": "2026-07-14T10:28:12.654Z",
"dateUpdated": "2026-07-28T14:51:03.684Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-42495 (GCVE-0-2026-42495)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:31 – Updated: 2026-07-28 15:01
VLAI
EPSS
VEX
Title
buffer overruns in libfsimage iso9660 handling
Summary
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver
derives several lengths directly from attacker-controlled on-disk fields
without validating them:
* The directory loop itself assumes a good record length. This is
CVE-2026-42494.
* The calculation of the System Use area may underflow. This is
CVE-2026-42495.
* The Rock Ridge extension loop assumes a good (inner) record length.
This is CVE-2026-62423.
* The Rock Ridge NM record processing assumes a good entry length.
This is CVE-2026-62424.
* The Rock Ridge CE record processing assumes a good size and offset.
This is CVE-2026-62425.
Severity
5.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-191 - Integer Underflow (Wrap or Wraparound)
Assigner
References
1 reference
Date Public
2026-07-28 12:00
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-42495",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T15:00:30.511503Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-191",
"description": "CWE-191 Integer Underflow (Wrap or Wraparound)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:01:03.756Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-497"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from at least 3.2 onwards are affected. Older versions\nhave not been inspected."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Syed Abdul Khaliq of BugQore."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nThe directory and Rock Ridge / SUSP walk in libfsimage\u0027s iso9660 driver\nderives several lengths directly from attacker-controlled on-disk fields\nwithout validating them:\n\n * The directory loop itself assumes a good record length. This is\n CVE-2026-42494.\n\n * The calculation of the System Use area may underflow. This is\n CVE-2026-42495.\n\n * The Rock Ridge extension loop assumes a good (inner) record length.\n This is CVE-2026-62423.\n\n * The Rock Ridge NM record processing assumes a good entry length.\n This is CVE-2026-62424.\n\n * The Rock Ridge CE record processing assumes a good size and offset.\n This is CVE-2026-62425."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "A guest using pygrub can escalate its privilege to that of the domain\nconstruction tools (i.e., normally, to control of the host).\n\nIf the mechanism introduced by XSA-443 (see the mitigation section below)\nis in use, then the guest can only escalate to this limited context."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:31:41.743Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-497.html"
}
],
"title": "buffer overruns in libfsimage iso9660 handling",
"workarounds": [
{
"lang": "en",
"value": "XSA-443 added a mechanism to run pygrub de-privileged. Using this mode\nwill mitigate the vulnerability.\n\nEnsuring that guests do not use the pygrub bootloader will avoid this\nvulnerability.\n\nFor cases where the PV guest is known to be 64bit, and uses grub2 as a\nbootloader, pvgrub is a suitable alternative to pygrub.\n\nRunning only HVM or PVH guests will avoid the vulnerability."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-42495",
"datePublished": "2026-07-28T12:31:41.743Z",
"dateReserved": "2026-04-27T14:20:24.139Z",
"dateUpdated": "2026-07-28T15:01:03.756Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-42494 (GCVE-0-2026-42494)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:31 – Updated: 2026-07-28 15:04
VLAI
EPSS
VEX
Title
buffer overruns in libfsimage iso9660 handling
Summary
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]
The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver
derives several lengths directly from attacker-controlled on-disk fields
without validating them:
* The directory loop itself assumes a good record length. This is
CVE-2026-42494.
* The calculation of the System Use area may underflow. This is
CVE-2026-42495.
* The Rock Ridge extension loop assumes a good (inner) record length.
This is CVE-2026-62423.
* The Rock Ridge NM record processing assumes a good entry length.
This is CVE-2026-62424.
* The Rock Ridge CE record processing assumes a good size and offset.
This is CVE-2026-62425.
Severity
6.1 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-125 - Out-of-bounds Read
Assigner
References
1 reference
Date Public
2026-07-28 12:00
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-42494",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T15:04:14.686627Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125 Out-of-bounds Read",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:04:48.405Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-497"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All Xen versions from at least 3.2 onwards are affected. Older versions\nhave not been inspected."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Syed Abdul Khaliq of BugQore."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "[This CNA information record relates to multiple CVEs; the\ntext explains which aspects/vulnerabilities correspond to which CVE.]\n\nThe directory and Rock Ridge / SUSP walk in libfsimage\u0027s iso9660 driver\nderives several lengths directly from attacker-controlled on-disk fields\nwithout validating them:\n\n * The directory loop itself assumes a good record length. This is\n CVE-2026-42494.\n\n * The calculation of the System Use area may underflow. This is\n CVE-2026-42495.\n\n * The Rock Ridge extension loop assumes a good (inner) record length.\n This is CVE-2026-62423.\n\n * The Rock Ridge NM record processing assumes a good entry length.\n This is CVE-2026-62424.\n\n * The Rock Ridge CE record processing assumes a good size and offset.\n This is CVE-2026-62425."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "A guest using pygrub can escalate its privilege to that of the domain\nconstruction tools (i.e., normally, to control of the host).\n\nIf the mechanism introduced by XSA-443 (see the mitigation section below)\nis in use, then the guest can only escalate to this limited context."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:31:41.682Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-497.html"
}
],
"title": "buffer overruns in libfsimage iso9660 handling",
"workarounds": [
{
"lang": "en",
"value": "XSA-443 added a mechanism to run pygrub de-privileged. Using this mode\nwill mitigate the vulnerability.\n\nEnsuring that guests do not use the pygrub bootloader will avoid this\nvulnerability.\n\nFor cases where the PV guest is known to be 64bit, and uses grub2 as a\nbootloader, pvgrub is a suitable alternative to pygrub.\n\nRunning only HVM or PVH guests will avoid the vulnerability."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-42494",
"datePublished": "2026-07-28T12:31:41.682Z",
"dateReserved": "2026-04-27T14:20:24.139Z",
"dateUpdated": "2026-07-28T15:04:48.405Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-42492 (GCVE-0-2026-42492)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:31 – Updated: 2026-07-28 16:33
VLAI
EPSS
VEX
Title
vIRQ event channel binding may break Xenstore
Summary
Xenstore, to have an up-to-date picture of the entire system, wants to
know of domains appearing and disappearing. To make this more robust, a
new XEN_DOMCTL_get_domain_state was introduced. The management of the
bitmap underlying that operation is tied into the binding of the
VIRQ_DOM_EXC virtual IRQ. Unfortunately an error path there would tear
down the bitmap even in cases when it wasn't set up. Unprivileged domains
can trigger that error path.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-459 - Incomplete Cleanup
Assigner
References
Date Public
2026-07-28 12:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-28T16:33:22.683Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://xenbits.xen.org/xsa/advisory-496.html"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/28/13"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-42492",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T15:56:49.876014Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-459",
"description": "CWE-459 Incomplete Cleanup",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:56:54.437Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-496"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "Xen 4.21 and onwards are vulnerable. Xen 4.20 and older are not\nvulnerable."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Grygorii Strashko of EPAM."
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Xenstore, to have an up-to-date picture of the entire system, wants to\nknow of domains appearing and disappearing. To make this more robust, a\nnew XEN_DOMCTL_get_domain_state was introduced. The management of the\nbitmap underlying that operation is tied into the binding of the\nVIRQ_DOM_EXC virtual IRQ. Unfortunately an error path there would tear\ndown the bitmap even in cases when it wasn\u0027t set up. Unprivileged domains\ncan trigger that error path."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "An unprivileged domain can affect the operation of Xenstore, potentially\nleading to a Denial of Service (DoS) affecting the entire host. A\nhypervisor crash with similar host wide effect also is possible, albeit\nunlikely."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:31:28.304Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-496.html"
}
],
"title": "vIRQ event channel binding may break Xenstore",
"workarounds": [
{
"lang": "en",
"value": "There is no known mitigation."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-42492",
"datePublished": "2026-07-28T12:31:28.304Z",
"dateReserved": "2026-04-27T14:20:24.139Z",
"dateUpdated": "2026-07-28T16:33:22.683Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-42493 (GCVE-0-2026-42493)
Vulnerability from cvelistv5 – Published: 2026-07-28 12:31 – Updated: 2026-07-28 16:33
VLAI
EPSS
VEX
Title
x86 shadow paging is deprecated
Summary
Addressing certain issues, in particular related to operations which may
take excessively long and therefore would need preemption, has turned out
overly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commonly
available, the decision was to deprecate the functionality, while still
retaining it for people to use at their own (security) risk. Memory-wise
small enough guests may still be okay to run.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-400 - Uncontrolled Resource Consumption
Assigner
References
Date Public
2026-07-28 12:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-28T16:33:23.792Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://xenbits.xen.org/xsa/advisory-495.html"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/07/28/12"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-42493",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-28T15:58:19.075241Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400 Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T15:58:45.484Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-495"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "All x86 systems with builds of Xen having SHADOW_PAGING=y are affected.\nNote that prior to Xen 4.7 this control didn\u0027t exist, and all builds of\nXen would be affected. (Strictly speaking Xen 4.6 had a different, harder\nto use mechanism to disable shadow paging support: One could pass\n\"shadow-paging=n\" on the make command line.)"
}
],
"datePublic": "2026-07-28T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Addressing certain issues, in particular related to operations which may\ntake excessively long and therefore would need preemption, has turned out\noverly costly. Since alternatives (HVM/PVH: HAP, PV: shim) are commonly\navailable, the decision was to deprecate the functionality, while still\nretaining it for people to use at their own (security) risk. Memory-wise\nsmall enough guests may still be okay to run."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "An unprivileged guest may be able to cause Denial of Service (DoS)\naffecting the entire host."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-28T12:31:11.950Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-495.html"
}
],
"title": "x86 shadow paging is deprecated",
"workarounds": [
{
"lang": "en",
"value": "Running HVM and PVH in Hardware Assisted Paging (HAP) mode will avoid this\nvulnerability.\n\nThere\u0027s no mitigation available for PV guests. This is because shadow\nmode, if support is enabled in the hypervisor, could be engaged at any\ntime. Note that without shadow mode built into Xen, guests not properly\ndealing with L1TF will simply be crashed instead."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-42493",
"datePublished": "2026-07-28T12:31:11.950Z",
"dateReserved": "2026-04-27T14:20:24.139Z",
"dateUpdated": "2026-07-28T16:33:23.792Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-42486 (GCVE-0-2026-42486)
Vulnerability from cvelistv5 – Published: 2026-07-09 15:16 – Updated: 2026-07-10 03:55
VLAI
EPSS
VEX
Title
Multiple RBAC issues in XAPI
Summary
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]
XAPI can configure different users with different roles, using Role
Based Access Control. For more details, see:
https://docs.xenserver.com/en-us/xencenter/current-release/rbac-overview.html#rbac-roles
The pool-admin role is fully privileged. Notably, users with this role
can also SSH into the host as root.
The other administrator roles are pool-operator, vm-power-admin and
vm-admin, each of which are authorised to configure and manage various
aspects of the system.
Some settings are inadequately restricted, and can be set by a lower
privilege of administrator than expected.
* CVE-2026-23559: A vm-admin can set VBD.other_config:backend-local and
turn arbitrary files in dom0 into VDIs (virtual disks) and give said
disks to a VM they control. This is an arbitrary read and/or modify
of files in dom0.
* CVE-2026-23560: A vm-admin can set VM.other-config:is_system_domain
and mark a VM as a system domain. System domains are ignored and
left running during certain other host/pool operations, and may be
hidden from view in tooling.
* CVE-2026-23561: A vm-admin can set VM.other_config:storage_driver_domain
and mark a VM as the storage domain for a particular host storage
connection (PBD). Shutting down the VM can cause the PBD to be
erroneously marked as unplugged when it is not.
* CVE-2026-23562: Configuration of PCI passthrough is normally
restricted to the pool-admin role. However one API was missing this
check, allowing a vm-admin access to unintended host hardware.
* CVE-2026-42486: A vm-admin can set the VM.platform:hvm_serial
parameter, which should be restricted to the pool-admin role, as it
can allow arbitrary dom0 file write.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-250 - Execution with unnecessary privileges
Assigner
References
1 reference
Date Public
2026-04-28 18:05
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-42486",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-09T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T03:55:43.730Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "XAPI",
"vendor": "Xen",
"versions": [
{
"status": "affected",
"version": "all"
}
]
}
],
"datePublic": "2026-04-28T18:05:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]\u003cbr\u003eXAPI can configure different users with different roles, using Role\u003cbr\u003eBased Access Control. For more details, see:\u003cbr\u003e\u003cbr\u003e https://docs.xenserver.com/en-us/xencenter/current-release/rbac-overview.html#rbac-roles\u003cbr\u003e\u003cbr\u003eThe pool-admin role is fully privileged. Notably, users with this role\u003cbr\u003ecan also SSH into the host as root.\u003cbr\u003e\u003cbr\u003eThe other administrator roles are pool-operator, vm-power-admin and\u003cbr\u003evm-admin, each of which are authorised to configure and manage various\u003cbr\u003easpects of the system.\u003cbr\u003e\u003cbr\u003eSome settings are inadequately restricted, and can be set by a lower\u003cbr\u003eprivilege of administrator than expected.\u003cbr\u003e\u003cbr\u003e * CVE-2026-23559: A vm-admin can set VBD.other_config:backend-local and\u003cbr\u003e turn arbitrary files in dom0 into VDIs (virtual disks) and give said\u003cbr\u003e disks to a VM they control. This is an arbitrary read and/or modify\u003cbr\u003e of files in dom0.\u003cbr\u003e\u003cbr\u003e * CVE-2026-23560: A vm-admin can set VM.other-config:is_system_domain\u003cbr\u003e and mark a VM as a system domain. System domains are ignored and\u003cbr\u003e left running during certain other host/pool operations, and may be\u003cbr\u003e hidden from view in tooling.\u003cbr\u003e\u003cbr\u003e * CVE-2026-23561: A vm-admin can set VM.other_config:storage_driver_domain\u003cbr\u003e and mark a VM as the storage domain for a particular host storage\u003cbr\u003e connection (PBD). Shutting down the VM can cause the PBD to be\u003cbr\u003e erroneously marked as unplugged when it is not.\u003cbr\u003e\u003cbr\u003e * CVE-2026-23562: Configuration of PCI passthrough is normally\u003cbr\u003e restricted to the pool-admin role. However one API was missing this\u003cbr\u003e check, allowing a vm-admin access to unintended host hardware.\u003cbr\u003e\u003cbr\u003e * CVE-2026-42486: A vm-admin can set the VM.platform:hvm_serial\u003cbr\u003e parameter, which should be restricted to the pool-admin role, as it\u003cbr\u003e can allow arbitrary dom0 file write."
}
],
"value": "[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]\nXAPI can configure different users with different roles, using Role\nBased Access Control. For more details, see:\n\n https://docs.xenserver.com/en-us/xencenter/current-release/rbac-overview.html#rbac-roles\n\nThe pool-admin role is fully privileged. Notably, users with this role\ncan also SSH into the host as root.\n\nThe other administrator roles are pool-operator, vm-power-admin and\nvm-admin, each of which are authorised to configure and manage various\naspects of the system.\n\nSome settings are inadequately restricted, and can be set by a lower\nprivilege of administrator than expected.\n\n * CVE-2026-23559: A vm-admin can set VBD.other_config:backend-local and\n turn arbitrary files in dom0 into VDIs (virtual disks) and give said\n disks to a VM they control. This is an arbitrary read and/or modify\n of files in dom0.\n\n * CVE-2026-23560: A vm-admin can set VM.other-config:is_system_domain\n and mark a VM as a system domain. System domains are ignored and\n left running during certain other host/pool operations, and may be\n hidden from view in tooling.\n\n * CVE-2026-23561: A vm-admin can set VM.other_config:storage_driver_domain\n and mark a VM as the storage domain for a particular host storage\n connection (PBD). Shutting down the VM can cause the PBD to be\n erroneously marked as unplugged when it is not.\n\n * CVE-2026-23562: Configuration of PCI passthrough is normally\n restricted to the pool-admin role. However one API was missing this\n check, allowing a vm-admin access to unintended host hardware.\n\n * CVE-2026-42486: A vm-admin can set the VM.platform:hvm_serial\n parameter, which should be restricted to the pool-admin role, as it\n can allow arbitrary dom0 file write."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-250",
"description": "CWE-250 Execution with unnecessary privileges",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T15:16:34.880Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xen.org/xsa/advisory-489.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Multiple RBAC issues in XAPI",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-42486",
"datePublished": "2026-07-09T15:16:34.880Z",
"dateReserved": "2026-04-27T14:20:24.138Z",
"dateUpdated": "2026-07-10T03:55:43.730Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23562 (GCVE-0-2026-23562)
Vulnerability from cvelistv5 – Published: 2026-07-09 15:15 – Updated: 2026-07-10 03:55
VLAI
EPSS
VEX
Title
Multiple RBAC issues in XAPI
Summary
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]
XAPI can configure different users with different roles, using Role
Based Access Control. For more details, see:
https://docs.xenserver.com/en-us/xencenter/current-release/rbac-overview.html#rbac-roles
The pool-admin role is fully privileged. Notably, users with this role
can also SSH into the host as root.
The other administrator roles are pool-operator, vm-power-admin and
vm-admin, each of which are authorised to configure and manage various
aspects of the system.
Some settings are inadequately restricted, and can be set by a lower
privilege of administrator than expected.
* CVE-2026-23559: A vm-admin can set VBD.other_config:backend-local and
turn arbitrary files in dom0 into VDIs (virtual disks) and give said
disks to a VM they control. This is an arbitrary read and/or modify
of files in dom0.
* CVE-2026-23560: A vm-admin can set VM.other-config:is_system_domain
and mark a VM as a system domain. System domains are ignored and
left running during certain other host/pool operations, and may be
hidden from view in tooling.
* CVE-2026-23561: A vm-admin can set VM.other_config:storage_driver_domain
and mark a VM as the storage domain for a particular host storage
connection (PBD). Shutting down the VM can cause the PBD to be
erroneously marked as unplugged when it is not.
* CVE-2026-23562: Configuration of PCI passthrough is normally
restricted to the pool-admin role. However one API was missing this
check, allowing a vm-admin access to unintended host hardware.
* CVE-2026-42486: A vm-admin can set the VM.platform:hvm_serial
parameter, which should be restricted to the pool-admin role, as it
can allow arbitrary dom0 file write.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-250 - Execution with unnecessary privileges
Assigner
References
1 reference
Date Public
2026-04-28 18:05
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-23562",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-09T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T03:55:42.936Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "XAPI",
"vendor": "Xen",
"versions": [
{
"status": "affected",
"version": "all"
}
]
}
],
"datePublic": "2026-04-28T18:05:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]\u003cbr\u003eXAPI can configure different users with different roles, using Role\u003cbr\u003eBased Access Control. For more details, see:\u003cbr\u003e\u003cbr\u003e https://docs.xenserver.com/en-us/xencenter/current-release/rbac-overview.html#rbac-roles\u003cbr\u003e\u003cbr\u003eThe pool-admin role is fully privileged. Notably, users with this role\u003cbr\u003ecan also SSH into the host as root.\u003cbr\u003e\u003cbr\u003eThe other administrator roles are pool-operator, vm-power-admin and\u003cbr\u003evm-admin, each of which are authorised to configure and manage various\u003cbr\u003easpects of the system.\u003cbr\u003e\u003cbr\u003eSome settings are inadequately restricted, and can be set by a lower\u003cbr\u003eprivilege of administrator than expected.\u003cbr\u003e\u003cbr\u003e * CVE-2026-23559: A vm-admin can set VBD.other_config:backend-local and\u003cbr\u003e turn arbitrary files in dom0 into VDIs (virtual disks) and give said\u003cbr\u003e disks to a VM they control. This is an arbitrary read and/or modify\u003cbr\u003e of files in dom0.\u003cbr\u003e\u003cbr\u003e * CVE-2026-23560: A vm-admin can set VM.other-config:is_system_domain\u003cbr\u003e and mark a VM as a system domain. System domains are ignored and\u003cbr\u003e left running during certain other host/pool operations, and may be\u003cbr\u003e hidden from view in tooling.\u003cbr\u003e\u003cbr\u003e * CVE-2026-23561: A vm-admin can set VM.other_config:storage_driver_domain\u003cbr\u003e and mark a VM as the storage domain for a particular host storage\u003cbr\u003e connection (PBD). Shutting down the VM can cause the PBD to be\u003cbr\u003e erroneously marked as unplugged when it is not.\u003cbr\u003e\u003cbr\u003e * CVE-2026-23562: Configuration of PCI passthrough is normally\u003cbr\u003e restricted to the pool-admin role. However one API was missing this\u003cbr\u003e check, allowing a vm-admin access to unintended host hardware.\u003cbr\u003e\u003cbr\u003e * CVE-2026-42486: A vm-admin can set the VM.platform:hvm_serial\u003cbr\u003e parameter, which should be restricted to the pool-admin role, as it\u003cbr\u003e can allow arbitrary dom0 file write."
}
],
"value": "[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]\nXAPI can configure different users with different roles, using Role\nBased Access Control. For more details, see:\n\n https://docs.xenserver.com/en-us/xencenter/current-release/rbac-overview.html#rbac-roles\n\nThe pool-admin role is fully privileged. Notably, users with this role\ncan also SSH into the host as root.\n\nThe other administrator roles are pool-operator, vm-power-admin and\nvm-admin, each of which are authorised to configure and manage various\naspects of the system.\n\nSome settings are inadequately restricted, and can be set by a lower\nprivilege of administrator than expected.\n\n * CVE-2026-23559: A vm-admin can set VBD.other_config:backend-local and\n turn arbitrary files in dom0 into VDIs (virtual disks) and give said\n disks to a VM they control. This is an arbitrary read and/or modify\n of files in dom0.\n\n * CVE-2026-23560: A vm-admin can set VM.other-config:is_system_domain\n and mark a VM as a system domain. System domains are ignored and\n left running during certain other host/pool operations, and may be\n hidden from view in tooling.\n\n * CVE-2026-23561: A vm-admin can set VM.other_config:storage_driver_domain\n and mark a VM as the storage domain for a particular host storage\n connection (PBD). Shutting down the VM can cause the PBD to be\n erroneously marked as unplugged when it is not.\n\n * CVE-2026-23562: Configuration of PCI passthrough is normally\n restricted to the pool-admin role. However one API was missing this\n check, allowing a vm-admin access to unintended host hardware.\n\n * CVE-2026-42486: A vm-admin can set the VM.platform:hvm_serial\n parameter, which should be restricted to the pool-admin role, as it\n can allow arbitrary dom0 file write."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-250",
"description": "CWE-250 Execution with unnecessary privileges",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T15:15:24.093Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xen.org/xsa/advisory-489.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Multiple RBAC issues in XAPI",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-23562",
"datePublished": "2026-07-09T15:15:24.093Z",
"dateReserved": "2026-01-14T13:07:36.961Z",
"dateUpdated": "2026-07-10T03:55:42.936Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23561 (GCVE-0-2026-23561)
Vulnerability from cvelistv5 – Published: 2026-07-09 15:13 – Updated: 2026-07-10 03:55
VLAI
EPSS
VEX
Title
Multiple RBAC issues in XAPI
Summary
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]
XAPI can configure different users with different roles, using Role
Based Access Control. For more details, see:
https://docs.xenserver.com/en-us/xencenter/current-release/rbac-overview.html#rbac-roles
The pool-admin role is fully privileged. Notably, users with this role
can also SSH into the host as root.
The other administrator roles are pool-operator, vm-power-admin and
vm-admin, each of which are authorised to configure and manage various
aspects of the system.
Some settings are inadequately restricted, and can be set by a lower
privilege of administrator than expected.
* CVE-2026-23559: A vm-admin can set VBD.other_config:backend-local and
turn arbitrary files in dom0 into VDIs (virtual disks) and give said
disks to a VM they control. This is an arbitrary read and/or modify
of files in dom0.
* CVE-2026-23560: A vm-admin can set VM.other-config:is_system_domain
and mark a VM as a system domain. System domains are ignored and
left running during certain other host/pool operations, and may be
hidden from view in tooling.
* CVE-2026-23561: A vm-admin can set VM.other_config:storage_driver_domain
and mark a VM as the storage domain for a particular host storage
connection (PBD). Shutting down the VM can cause the PBD to be
erroneously marked as unplugged when it is not.
* CVE-2026-23562: Configuration of PCI passthrough is normally
restricted to the pool-admin role. However one API was missing this
check, allowing a vm-admin access to unintended host hardware.
* CVE-2026-42486: A vm-admin can set the VM.platform:hvm_serial
parameter, which should be restricted to the pool-admin role, as it
can allow arbitrary dom0 file write.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-250 - Execution with unnecessary privileges
Assigner
References
1 reference
Date Public
2026-04-28 18:05
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-23561",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-09T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-10T03:55:44.455Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "XAPI",
"vendor": "Xen",
"versions": [
{
"status": "affected",
"version": "all"
}
]
}
],
"datePublic": "2026-04-28T18:05:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]\u003cbr\u003eXAPI can configure different users with different roles, using Role\u003cbr\u003eBased Access Control. For more details, see:\u003cbr\u003e\u003cbr\u003e https://docs.xenserver.com/en-us/xencenter/current-release/rbac-overview.html#rbac-roles\u003cbr\u003e\u003cbr\u003eThe pool-admin role is fully privileged. Notably, users with this role\u003cbr\u003ecan also SSH into the host as root.\u003cbr\u003e\u003cbr\u003eThe other administrator roles are pool-operator, vm-power-admin and\u003cbr\u003evm-admin, each of which are authorised to configure and manage various\u003cbr\u003easpects of the system.\u003cbr\u003e\u003cbr\u003eSome settings are inadequately restricted, and can be set by a lower\u003cbr\u003eprivilege of administrator than expected.\u003cbr\u003e\u003cbr\u003e * CVE-2026-23559: A vm-admin can set VBD.other_config:backend-local and\u003cbr\u003e turn arbitrary files in dom0 into VDIs (virtual disks) and give said\u003cbr\u003e disks to a VM they control. This is an arbitrary read and/or modify\u003cbr\u003e of files in dom0.\u003cbr\u003e\u003cbr\u003e * CVE-2026-23560: A vm-admin can set VM.other-config:is_system_domain\u003cbr\u003e and mark a VM as a system domain. System domains are ignored and\u003cbr\u003e left running during certain other host/pool operations, and may be\u003cbr\u003e hidden from view in tooling.\u003cbr\u003e\u003cbr\u003e * CVE-2026-23561: A vm-admin can set VM.other_config:storage_driver_domain\u003cbr\u003e and mark a VM as the storage domain for a particular host storage\u003cbr\u003e connection (PBD). Shutting down the VM can cause the PBD to be\u003cbr\u003e erroneously marked as unplugged when it is not.\u003cbr\u003e\u003cbr\u003e * CVE-2026-23562: Configuration of PCI passthrough is normally\u003cbr\u003e restricted to the pool-admin role. However one API was missing this\u003cbr\u003e check, allowing a vm-admin access to unintended host hardware.\u003cbr\u003e\u003cbr\u003e * CVE-2026-42486: A vm-admin can set the VM.platform:hvm_serial\u003cbr\u003e parameter, which should be restricted to the pool-admin role, as it\u003cbr\u003e can allow arbitrary dom0 file write."
}
],
"value": "[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]\nXAPI can configure different users with different roles, using Role\nBased Access Control. For more details, see:\n\n https://docs.xenserver.com/en-us/xencenter/current-release/rbac-overview.html#rbac-roles\n\nThe pool-admin role is fully privileged. Notably, users with this role\ncan also SSH into the host as root.\n\nThe other administrator roles are pool-operator, vm-power-admin and\nvm-admin, each of which are authorised to configure and manage various\naspects of the system.\n\nSome settings are inadequately restricted, and can be set by a lower\nprivilege of administrator than expected.\n\n * CVE-2026-23559: A vm-admin can set VBD.other_config:backend-local and\n turn arbitrary files in dom0 into VDIs (virtual disks) and give said\n disks to a VM they control. This is an arbitrary read and/or modify\n of files in dom0.\n\n * CVE-2026-23560: A vm-admin can set VM.other-config:is_system_domain\n and mark a VM as a system domain. System domains are ignored and\n left running during certain other host/pool operations, and may be\n hidden from view in tooling.\n\n * CVE-2026-23561: A vm-admin can set VM.other_config:storage_driver_domain\n and mark a VM as the storage domain for a particular host storage\n connection (PBD). Shutting down the VM can cause the PBD to be\n erroneously marked as unplugged when it is not.\n\n * CVE-2026-23562: Configuration of PCI passthrough is normally\n restricted to the pool-admin role. However one API was missing this\n check, allowing a vm-admin access to unintended host hardware.\n\n * CVE-2026-42486: A vm-admin can set the VM.platform:hvm_serial\n parameter, which should be restricted to the pool-admin role, as it\n can allow arbitrary dom0 file write."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-250",
"description": "CWE-250 Execution with unnecessary privileges",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T15:13:50.370Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xen.org/xsa/advisory-489.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Multiple RBAC issues in XAPI",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-23561",
"datePublished": "2026-07-09T15:13:22.160Z",
"dateReserved": "2026-01-14T13:07:36.961Z",
"dateUpdated": "2026-07-10T03:55:44.455Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23560 (GCVE-0-2026-23560)
Vulnerability from cvelistv5 – Published: 2026-07-09 15:12 – Updated: 2026-07-09 16:08
VLAI
EPSS
VEX
Title
Multiple RBAC issues in XAPI
Summary
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]
XAPI can configure different users with different roles, using Role
Based Access Control. For more details, see:
https://docs.xenserver.com/en-us/xencenter/current-release/rbac-overview.html#rbac-roles
The pool-admin role is fully privileged. Notably, users with this role
can also SSH into the host as root.
The other administrator roles are pool-operator, vm-power-admin and
vm-admin, each of which are authorised to configure and manage various
aspects of the system.
Some settings are inadequately restricted, and can be set by a lower
privilege of administrator than expected.
* CVE-2026-23559: A vm-admin can set VBD.other_config:backend-local and
turn arbitrary files in dom0 into VDIs (virtual disks) and give said
disks to a VM they control. This is an arbitrary read and/or modify
of files in dom0.
* CVE-2026-23560: A vm-admin can set VM.other-config:is_system_domain
and mark a VM as a system domain. System domains are ignored and
left running during certain other host/pool operations, and may be
hidden from view in tooling.
* CVE-2026-23561: A vm-admin can set VM.other_config:storage_driver_domain
and mark a VM as the storage domain for a particular host storage
connection (PBD). Shutting down the VM can cause the PBD to be
erroneously marked as unplugged when it is not.
* CVE-2026-23562: Configuration of PCI passthrough is normally
restricted to the pool-admin role. However one API was missing this
check, allowing a vm-admin access to unintended host hardware.
* CVE-2026-42486: A vm-admin can set the VM.platform:hvm_serial
parameter, which should be restricted to the pool-admin role, as it
can allow arbitrary dom0 file write.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-250 - Execution with unnecessary privileges
Assigner
References
1 reference
Date Public
2026-04-28 18:05
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-23560",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-09T16:08:07.196380Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T16:08:13.898Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "XAPI",
"vendor": "Xen",
"versions": [
{
"status": "affected",
"version": "all"
}
]
}
],
"datePublic": "2026-04-28T18:05:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]\u003cbr\u003eXAPI can configure different users with different roles, using Role\u003cbr\u003eBased Access Control. For more details, see:\u003cbr\u003e\u003cbr\u003e https://docs.xenserver.com/en-us/xencenter/current-release/rbac-overview.html#rbac-roles\u003cbr\u003e\u003cbr\u003eThe pool-admin role is fully privileged. Notably, users with this role\u003cbr\u003ecan also SSH into the host as root.\u003cbr\u003e\u003cbr\u003eThe other administrator roles are pool-operator, vm-power-admin and\u003cbr\u003evm-admin, each of which are authorised to configure and manage various\u003cbr\u003easpects of the system.\u003cbr\u003e\u003cbr\u003eSome settings are inadequately restricted, and can be set by a lower\u003cbr\u003eprivilege of administrator than expected.\u003cbr\u003e\u003cbr\u003e * CVE-2026-23559: A vm-admin can set VBD.other_config:backend-local and\u003cbr\u003e turn arbitrary files in dom0 into VDIs (virtual disks) and give said\u003cbr\u003e disks to a VM they control. This is an arbitrary read and/or modify\u003cbr\u003e of files in dom0.\u003cbr\u003e\u003cbr\u003e * CVE-2026-23560: A vm-admin can set VM.other-config:is_system_domain\u003cbr\u003e and mark a VM as a system domain. System domains are ignored and\u003cbr\u003e left running during certain other host/pool operations, and may be\u003cbr\u003e hidden from view in tooling.\u003cbr\u003e\u003cbr\u003e * CVE-2026-23561: A vm-admin can set VM.other_config:storage_driver_domain\u003cbr\u003e and mark a VM as the storage domain for a particular host storage\u003cbr\u003e connection (PBD). Shutting down the VM can cause the PBD to be\u003cbr\u003e erroneously marked as unplugged when it is not.\u003cbr\u003e\u003cbr\u003e * CVE-2026-23562: Configuration of PCI passthrough is normally\u003cbr\u003e restricted to the pool-admin role. However one API was missing this\u003cbr\u003e check, allowing a vm-admin access to unintended host hardware.\u003cbr\u003e\u003cbr\u003e * CVE-2026-42486: A vm-admin can set the VM.platform:hvm_serial\u003cbr\u003e parameter, which should be restricted to the pool-admin role, as it\u003cbr\u003e can allow arbitrary dom0 file write."
}
],
"value": "[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]\nXAPI can configure different users with different roles, using Role\nBased Access Control. For more details, see:\n\n https://docs.xenserver.com/en-us/xencenter/current-release/rbac-overview.html#rbac-roles\n\nThe pool-admin role is fully privileged. Notably, users with this role\ncan also SSH into the host as root.\n\nThe other administrator roles are pool-operator, vm-power-admin and\nvm-admin, each of which are authorised to configure and manage various\naspects of the system.\n\nSome settings are inadequately restricted, and can be set by a lower\nprivilege of administrator than expected.\n\n * CVE-2026-23559: A vm-admin can set VBD.other_config:backend-local and\n turn arbitrary files in dom0 into VDIs (virtual disks) and give said\n disks to a VM they control. This is an arbitrary read and/or modify\n of files in dom0.\n\n * CVE-2026-23560: A vm-admin can set VM.other-config:is_system_domain\n and mark a VM as a system domain. System domains are ignored and\n left running during certain other host/pool operations, and may be\n hidden from view in tooling.\n\n * CVE-2026-23561: A vm-admin can set VM.other_config:storage_driver_domain\n and mark a VM as the storage domain for a particular host storage\n connection (PBD). Shutting down the VM can cause the PBD to be\n erroneously marked as unplugged when it is not.\n\n * CVE-2026-23562: Configuration of PCI passthrough is normally\n restricted to the pool-admin role. However one API was missing this\n check, allowing a vm-admin access to unintended host hardware.\n\n * CVE-2026-42486: A vm-admin can set the VM.platform:hvm_serial\n parameter, which should be restricted to the pool-admin role, as it\n can allow arbitrary dom0 file write."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-250",
"description": "CWE-250 Execution with unnecessary privileges",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T15:12:00.013Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xen.org/xsa/advisory-489.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Multiple RBAC issues in XAPI",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-23560",
"datePublished": "2026-07-09T15:12:00.013Z",
"dateReserved": "2026-01-14T13:07:36.961Z",
"dateUpdated": "2026-07-09T16:08:13.898Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23559 (GCVE-0-2026-23559)
Vulnerability from cvelistv5 – Published: 2026-07-09 15:09 – Updated: 2026-07-09 16:02
VLAI
EPSS
VEX
Title
Multiple RBAC issues in XAPI
Summary
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]
XAPI can configure different users with different roles, using Role
Based Access Control. For more details, see:
https://docs.xenserver.com/en-us/xencenter/current-release/rbac-overview.html#rbac-roles
The pool-admin role is fully privileged. Notably, users with this role
can also SSH into the host as root.
The other administrator roles are pool-operator, vm-power-admin and
vm-admin, each of which are authorised to configure and manage various
aspects of the system.
Some settings are inadequately restricted, and can be set by a lower
privilege of administrator than expected.
* CVE-2026-23559: A vm-admin can set VBD.other_config:backend-local and
turn arbitrary files in dom0 into VDIs (virtual disks) and give said
disks to a VM they control. This is an arbitrary read and/or modify
of files in dom0.
* CVE-2026-23560: A vm-admin can set VM.other-config:is_system_domain
and mark a VM as a system domain. System domains are ignored and
left running during certain other host/pool operations, and may be
hidden from view in tooling.
* CVE-2026-23561: A vm-admin can set VM.other_config:storage_driver_domain
and mark a VM as the storage domain for a particular host storage
connection (PBD). Shutting down the VM can cause the PBD to be
erroneously marked as unplugged when it is not.
* CVE-2026-23562: Configuration of PCI passthrough is normally
restricted to the pool-admin role. However one API was missing this
check, allowing a vm-admin access to unintended host hardware.
* CVE-2026-42486: A vm-admin can set the VM.platform:hvm_serial
parameter, which should be restricted to the pool-admin role, as it
can allow arbitrary dom0 file write.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-250 - Execution with unnecessary privileges
Assigner
References
1 reference
Date Public
2026-04-29 18:05
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-23559",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-09T16:02:25.587757Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T16:02:32.186Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "XAPI",
"vendor": "Xen",
"versions": [
{
"status": "affected",
"version": "all"
}
]
}
],
"datePublic": "2026-04-29T18:05:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]\u003cbr\u003e\u003cpre\u003eXAPI can configure different users with different roles, using Role\nBased Access Control. For more details, see:\n\n \u003ca href=\"https://docs.xenserver.com/en-us/xencenter/current-release/rbac-overview.html#rbac-roles\"\u003ehttps://docs.xenserver.com/en-us/xencenter/current-release/rbac-overview.html#rbac-roles\u003c/a\u003e\n\nThe pool-admin role is fully privileged. Notably, users with this role\ncan also SSH into the host as root.\n\nThe other administrator roles are pool-operator, vm-power-admin and\nvm-admin, each of which are authorised to configure and manage various\naspects of the system.\n\nSome settings are inadequately restricted, and can be set by a lower\nprivilege of administrator than expected.\n\n * CVE-2026-23559: A vm-admin can set VBD.other_config:backend-local and\n turn arbitrary files in dom0 into VDIs (virtual disks) and give said\n disks to a VM they control. This is an arbitrary read and/or modify\n of files in dom0.\n\n * CVE-2026-23560: A vm-admin can set VM.other-config:is_system_domain\n and mark a VM as a system domain. System domains are ignored and\n left running during certain other host/pool operations, and may be\n hidden from view in tooling.\n\n * CVE-2026-23561: A vm-admin can set VM.other_config:storage_driver_domain\n and mark a VM as the storage domain for a particular host storage\n connection (PBD). Shutting down the VM can cause the PBD to be\n erroneously marked as unplugged when it is not.\n\n * CVE-2026-23562: Configuration of PCI passthrough is normally\n restricted to the pool-admin role. However one API was missing this\n check, allowing a vm-admin access to unintended host hardware.\n\n * CVE-2026-42486: A vm-admin can set the VM.platform:hvm_serial\n parameter, which should be restricted to the pool-admin role, as it\n can allow arbitrary dom0 file write.\u003c/pre\u003e"
}
],
"value": "[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]\n\n\nXAPI can configure different users with different roles, using Role\nBased Access Control. For more details, see:\n\n https://docs.xenserver.com/en-us/xencenter/current-release/rbac-overview.html#rbac-roles \n\nThe pool-admin role is fully privileged. Notably, users with this role\ncan also SSH into the host as root.\n\nThe other administrator roles are pool-operator, vm-power-admin and\nvm-admin, each of which are authorised to configure and manage various\naspects of the system.\n\nSome settings are inadequately restricted, and can be set by a lower\nprivilege of administrator than expected.\n\n * CVE-2026-23559: A vm-admin can set VBD.other_config:backend-local and\n turn arbitrary files in dom0 into VDIs (virtual disks) and give said\n disks to a VM they control. This is an arbitrary read and/or modify\n of files in dom0.\n\n * CVE-2026-23560: A vm-admin can set VM.other-config:is_system_domain\n and mark a VM as a system domain. System domains are ignored and\n left running during certain other host/pool operations, and may be\n hidden from view in tooling.\n\n * CVE-2026-23561: A vm-admin can set VM.other_config:storage_driver_domain\n and mark a VM as the storage domain for a particular host storage\n connection (PBD). Shutting down the VM can cause the PBD to be\n erroneously marked as unplugged when it is not.\n\n * CVE-2026-23562: Configuration of PCI passthrough is normally\n restricted to the pool-admin role. However one API was missing this\n check, allowing a vm-admin access to unintended host hardware.\n\n * CVE-2026-42486: A vm-admin can set the VM.platform:hvm_serial\n parameter, which should be restricted to the pool-admin role, as it\n can allow arbitrary dom0 file write."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-250",
"description": "CWE-250 Execution with unnecessary privileges",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T15:09:51.762Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xen.org/xsa/advisory-489.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Multiple RBAC issues in XAPI",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-23559",
"datePublished": "2026-07-09T15:09:51.762Z",
"dateReserved": "2026-01-14T13:07:36.961Z",
"dateUpdated": "2026-07-09T16:02:32.186Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-23556 (GCVE-0-2026-23556)
Vulnerability from cvelistv5 – Published: 2026-07-09 14:48 – Updated: 2026-07-09 15:37
VLAI
EPSS
VEX
Title
oxenstored keeps quota related use counts across domain destruction
Summary
When oxenstored is tearing a domain down, the node data is cleaned up
but the usage counts are leaked.
When the domain ID is eventually reused, the new domain can create fewer
nodes before beeing deemed to be over quota.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-281 - Improper preservation of permissions
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Xen | oxenstored |
Affected:
all
|
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-09T15:06:25.267Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/04/28/10"
},
{
"url": "http://xenbits.xen.org/xsa/advisory-483.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-23556",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-09T15:34:22.728700Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T15:37:46.026Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "oxenstored",
"vendor": "Xen",
"versions": [
{
"status": "affected",
"version": "all"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Andrii Sultanov of Vates."
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003eWhen oxenstored is tearing a domain down, the node data is cleaned up\nbut the usage counts are leaked.\n\nWhen the domain ID is eventually reused, the new domain can create fewer\nnodes before beeing deemed to be over quota.\u003c/pre\u003e"
}
],
"value": "When oxenstored is tearing a domain down, the node data is cleaned up\nbut the usage counts are leaked.\n\nWhen the domain ID is eventually reused, the new domain can create fewer\nnodes before beeing deemed to be over quota."
}
],
"impacts": [
{
"capecId": "CAPEC-548",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-548 Contaminate Resource"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-281",
"description": "CWE-281 Improper preservation of permissions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T14:48:56.630Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xen.org/xsa/advisory-483.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "oxenstored keeps quota related use counts across domain destruction",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-23556",
"datePublished": "2026-07-09T14:48:56.630Z",
"dateReserved": "2026-01-14T13:07:36.961Z",
"dateUpdated": "2026-07-09T15:37:46.026Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-58151 (GCVE-0-2025-58151)
Vulnerability from cvelistv5 – Published: 2026-07-09 14:45 – Updated: 2026-07-09 15:41
VLAI
EPSS
VEX
Title
varstored: TOCTOU issues with mapped guest memory
Summary
varstored is a component of the Xapi toolstack handling UEFI Variables
for a VM. It has a communication path with OVMF inside the VM involving
mapping a buffer prepared by OVMF.
Within varstored, there were insufficient compiler barriers, creating
TOCTOU issues with data in the shared buffer.
The exact vulnerable behaviour depends on the code generated by the
compiler. In a build of varstored using default settings, the attacker
can control an index used in a jump table.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-367 - Time-of-check time-of-use (TOCTOU) race condition
Assigner
References
Date Public
2026-01-27 13:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-09T15:05:08.753Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2026/01/27/2"
},
{
"url": "http://xenbits.xen.org/xsa/advisory-478.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-58151",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-09T15:40:36.292177Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T15:41:25.431Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "varstored",
"vendor": "Xen",
"versions": [
{
"status": "affected",
"version": "all"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Teddy Astie of Vates."
}
],
"datePublic": "2026-01-27T13:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003evarstored is a component of the Xapi toolstack handling UEFI Variables\nfor a VM. It has a communication path with OVMF inside the VM involving\nmapping a buffer prepared by OVMF.\n\nWithin varstored, there were insufficient compiler barriers, creating\nTOCTOU issues with data in the shared buffer.\n\nThe exact vulnerable behaviour depends on the code generated by the\ncompiler. In a build of varstored using default settings, the attacker\ncan control an index used in a jump table.\u003c/pre\u003e"
}
],
"value": "varstored is a component of the Xapi toolstack handling UEFI Variables\nfor a VM. It has a communication path with OVMF inside the VM involving\nmapping a buffer prepared by OVMF.\n\nWithin varstored, there were insufficient compiler barriers, creating\nTOCTOU issues with data in the shared buffer.\n\nThe exact vulnerable behaviour depends on the code generated by the\ncompiler. In a build of varstored using default settings, the attacker\ncan control an index used in a jump table."
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-367",
"description": "CWE-367 Time-of-check time-of-use (TOCTOU) race condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T14:45:16.531Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xen.org/xsa/advisory-478.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "varstored: TOCTOU issues with mapped guest memory",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2025-58151",
"datePublished": "2026-07-09T14:45:16.531Z",
"dateReserved": "2025-08-26T06:48:41.444Z",
"dateUpdated": "2026-07-09T15:41:25.431Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-58146 (GCVE-0-2025-58146)
Vulnerability from cvelistv5 – Published: 2026-07-09 14:42 – Updated: 2026-07-09 16:07
VLAI
EPSS
VEX
Title
XAPI UTF-8 string handling
Summary
There are multiple issues.
1. Updates to the XAPI database sanitise input strings, but try
generating the notification using the unsanitised input. This
causes the database's event thread to terminate and cease further
processing.
2. XAPI's UTF-8 encoder implements v3.0 of the Unicode spec, but XAPI
uses libraries which conform to the stricter v3.1 of the Unicode
spec. This causes some strings to be accepted as valid UTF-8 by
XAPI, but rejected by other libraries in use. Notably, such strings
can be entered into the database, after which the database can no
longer be loaded.
3. There is no input sanitisation for Map/Set updates on objects in the
XAPI database.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-20 - Improper input validation
Assigner
References
Date Public
2025-09-09 12:00
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2026-07-09T15:04:54.978Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://www.openwall.com/lists/oss-security/2025/09/09/3"
},
{
"url": "http://xenbits.xen.org/xsa/advisory-474.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-58146",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-09T16:07:50.376243Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T16:07:56.939Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Linux"
],
"product": "XAPI",
"vendor": "Xen",
"versions": [
{
"status": "affected",
"version": "all"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Edwin T\u00f6r\u00f6k from XenServer."
}
],
"datePublic": "2025-09-09T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cpre\u003eThere are multiple issues.\n\n 1. Updates to the XAPI database sanitise input strings, but try\n generating the notification using the unsanitised input. This\n causes the database\u0027s event thread to terminate and cease further\n processing.\n\n 2. XAPI\u0027s UTF-8 encoder implements v3.0 of the Unicode spec, but XAPI\n uses libraries which conform to the stricter v3.1 of the Unicode\n spec. This causes some strings to be accepted as valid UTF-8 by\n XAPI, but rejected by other libraries in use. Notably, such strings\n can be entered into the database, after which the database can no\n longer be loaded.\n\n 3. There is no input sanitisation for Map/Set updates on objects in the\n XAPI database.\u003c/pre\u003e"
}
],
"value": "There are multiple issues.\n\n 1. Updates to the XAPI database sanitise input strings, but try\n generating the notification using the unsanitised input. This\n causes the database\u0027s event thread to terminate and cease further\n processing.\n\n 2. XAPI\u0027s UTF-8 encoder implements v3.0 of the Unicode spec, but XAPI\n uses libraries which conform to the stricter v3.1 of the Unicode\n spec. This causes some strings to be accepted as valid UTF-8 by\n XAPI, but rejected by other libraries in use. Notably, such strings\n can be entered into the database, after which the database can no\n longer be loaded.\n\n 3. There is no input sanitisation for Map/Set updates on objects in the\n XAPI database."
}
],
"impacts": [
{
"capecId": "CAPEC-272",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-272 Protocol Manipulation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper input validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T14:42:22.690Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xen.org/xsa/advisory-474.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "XAPI UTF-8 string handling",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2025-58146",
"datePublished": "2026-07-09T14:42:22.690Z",
"dateReserved": "2025-08-26T06:48:41.443Z",
"dateUpdated": "2026-07-09T16:07:56.939Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-27464 (GCVE-0-2025-27464)
Vulnerability from cvelistv5 – Published: 2026-07-09 14:35 – Updated: 2026-07-09 16:07
VLAI
EPSS
VEX
Title
WinPVDrivers: Excessive permissions on user-exposed devices
Summary
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windows PV drivers expose various facilities to userspace. Several of these have no security descriptor, and are therefore fully accessible to unprivileged users. These are: 1. XenCons, CVE-2025-27462 2. XenIface, CVE-2025-27463 3. XenBus, CVE-2025-27464
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-276 - Incorrect default permissions
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Xen | Windows PV drivers |
Affected:
all
|
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-27464",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-09T16:07:34.962961Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T16:07:40.763Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Windows PV drivers",
"vendor": "Xen",
"versions": [
{
"status": "affected",
"version": "all"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Tu Dinh of Vates"
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windows PV drivers expose various facilities to userspace. Several of these have no security descriptor, and are therefore fully accessible to unprivileged users. These are: 1. XenCons, CVE-2025-27462 2. XenIface, CVE-2025-27463 3. XenBus, CVE-2025-27464"
}
],
"value": "[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windows PV drivers expose various facilities to userspace. Several of these have no security descriptor, and are therefore fully accessible to unprivileged users. These are: 1. XenCons, CVE-2025-27462 2. XenIface, CVE-2025-27463 3. XenBus, CVE-2025-27464"
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-276",
"description": "CWE-276 Incorrect default permissions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T14:35:38.440Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xen.org/xsa/advisory-468.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "WinPVDrivers: Excessive permissions on user-exposed devices",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2025-27464",
"datePublished": "2026-07-09T14:35:38.440Z",
"dateReserved": "2025-02-26T09:16:54.461Z",
"dateUpdated": "2026-07-09T16:07:40.763Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-27463 (GCVE-0-2025-27463)
Vulnerability from cvelistv5 – Published: 2026-07-09 14:29 – Updated: 2026-07-09 15:52
VLAI
EPSS
VEX
Title
WinPVDrivers: Excessive permissions on user-exposed devices
Summary
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windows PV drivers expose various facilities to userspace. Several of these have no security descriptor, and are therefore fully accessible to unprivileged users. These are: 1. XenCons, CVE-2025-27462 2. XenIface, CVE-2025-27463 3. XenBus, CVE-2025-27464
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-276 - Incorrect default permissions
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Xen | Windows PV drivers |
Affected:
all
|
Date Public
2025-05-27 12:00
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-27463",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-09T15:51:32.481576Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T15:52:14.394Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Windows PV drivers",
"vendor": "Xen",
"versions": [
{
"status": "affected",
"version": "all"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Tu Dinh of Vates"
}
],
"datePublic": "2025-05-27T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windows PV drivers expose various facilities to userspace. Several of these have no security descriptor, and are therefore fully accessible to unprivileged users. These are: 1. XenCons, CVE-2025-27462 2. XenIface, CVE-2025-27463 3. XenBus, CVE-2025-27464"
}
],
"value": "[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windows PV drivers expose various facilities to userspace. Several of these have no security descriptor, and are therefore fully accessible to unprivileged users. These are: 1. XenCons, CVE-2025-27462 2. XenIface, CVE-2025-27463 3. XenBus, CVE-2025-27464"
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-276",
"description": "CWE-276 Incorrect default permissions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T14:29:49.625Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xen.org/xsa/advisory-468.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "WinPVDrivers: Excessive permissions on user-exposed devices",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2025-27463",
"datePublished": "2026-07-09T14:29:49.625Z",
"dateReserved": "2025-02-26T09:16:54.461Z",
"dateUpdated": "2026-07-09T15:52:14.394Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-27462 (GCVE-0-2025-27462)
Vulnerability from cvelistv5 – Published: 2026-07-09 14:27 – Updated: 2026-07-09 16:06
VLAI
EPSS
VEX
Title
WinPVDrivers: Excessive permissions on user-exposed devices
Summary
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]
The Windows PV drivers expose various facilities to userspace. Several
of these have no security descriptor, and are therefore fully accessible
to unprivileged users. These are:
1. XenCons, CVE-2025-27462
2. XenIface, CVE-2025-27463
3. XenBus, CVE-2025-27464
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-276 - Incorrect default permissions
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Xen | Windows PV drivers |
Affected:
all
|
Date Public
2025-05-27 12:00
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-27462",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-07-09T16:06:53.503103Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T16:06:58.873Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"platforms": [
"Windows"
],
"product": "Windows PV drivers",
"vendor": "Xen",
"versions": [
{
"status": "affected",
"version": "all"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Tu Dinh of Vates"
}
],
"datePublic": "2025-05-27T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]\u003cbr\u003e\u003cpre\u003eThe Windows PV drivers expose various facilities to userspace. Several\nof these have no security descriptor, and are therefore fully accessible\nto unprivileged users. These are:\n\n 1. XenCons, CVE-2025-27462\n 2. XenIface, CVE-2025-27463\n 3. XenBus, CVE-2025-27464\u003c/pre\u003e"
}
],
"value": "[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]\n\n\nThe Windows PV drivers expose various facilities to userspace. Several\nof these have no security descriptor, and are therefore fully accessible\nto unprivileged users. These are:\n\n 1. XenCons, CVE-2025-27462\n 2. XenIface, CVE-2025-27463\n 3. XenBus, CVE-2025-27464"
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "LOCAL",
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-276",
"description": "CWE-276 Incorrect default permissions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-09T14:27:03.467Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xen.org/xsa/advisory-468.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "WinPVDrivers: Excessive permissions on user-exposed devices",
"x_generator": {
"engine": "Vulnogram 1.0.2"
}
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2025-27462",
"datePublished": "2026-07-09T14:27:03.467Z",
"dateReserved": "2025-02-26T09:16:54.461Z",
"dateUpdated": "2026-07-09T16:06:58.873Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-42488 (GCVE-0-2026-42488)
Vulnerability from cvelistv5 – Published: 2026-06-18 13:47 – Updated: 2026-06-18 15:07
VLAI
EPSS
VEX
Title
x86: mismatched mapcache metadata
Summary
Some shadow paging errors paths will switch the page-tables without
updating the currently running vCPU reference. This causes a mismatch
between the loaded page-tables and the mapcache metadata which can lead
to corruption of the mapcache.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
Assigner
References
Date Public
2026-06-09 12:00
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2026-42488",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-18T15:02:17.385668Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-119",
"description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-18T15:03:20.373Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2026-06-18T15:07:35.190Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "http://xenbits.xen.org/xsa/advisory-494.html"
},
{
"url": "http://www.openwall.com/lists/oss-security/2026/06/09/14"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unknown",
"product": "Xen",
"vendor": "Xen",
"versions": [
{
"status": "unknown",
"version": "consult Xen advisory XSA-494"
}
]
}
],
"configurations": [
{
"lang": "en",
"value": "Xen 4.15 and onwards are vulnerable. Any Xen version with the fix for\nXSA-438 applied is vulnerable.\n\nOnly x86 systems are vulnerable. Only 64-bit PV guests can leverage the\nvulnerability, and only when running in shadow mode. Shadow mode would\nbe in use when migrating guests or as a workaround for XSA-273 (L1TF)."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "This issue was discovered by Roger Pau Monn\u00e9 of XenServer."
}
],
"datePublic": "2026-06-09T12:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Some shadow paging errors paths will switch the page-tables without\nupdating the currently running vCPU reference. This causes a mismatch\nbetween the loaded page-tables and the mapcache metadata which can lead\nto corruption of the mapcache."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Privilege escalation, Denial of Service (DoS) affecting the entire host,\nand information leaks."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-06-18T13:47:23.838Z",
"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"shortName": "XEN"
},
"references": [
{
"url": "https://xenbits.xenproject.org/xsa/advisory-494.html"
}
],
"title": "x86: mismatched mapcache metadata",
"workarounds": [
{
"lang": "en",
"value": "Running only HVM or PVH guests will avoid the vulnerability.\n\nRunning PV guests in the PV shim will also avoid the vulnerability."
}
]
}
},
"cveMetadata": {
"assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
"assignerShortName": "XEN",
"cveId": "CVE-2026-42488",
"datePublished": "2026-06-18T13:47:23.838Z",
"dateReserved": "2026-04-27T14:20:24.138Z",
"dateUpdated": "2026-06-18T15:07:35.190Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}