CVE-2007-0998

HVM guest VNC server allows compromise of entire host OS by any VNC console user

The VNC server implementation in QEMU, as used by Xen and possibly other environments, allows local users of a guest operating system to read arbitrary files on the host operating system via unspecified vectors related to QEMU monitor mode, as demonstrated by mapping files to a CDROM device. NOTE: some of these details are obtained from third party information.

CVSS 2.0 · 4.3 Medium EPSS 2.0% KEV · Not listed

Vendors

Redhat Xen

Products

Enterprise Linux Fedora Core Qemu

CVE-2007-6416

Security: vulnerability of copy_to_user in PAL emulation

The copy_to_user function in the PAL emulation functionality for Xen 3.1.2 and earlier, when running on ia64 systems, allows HVM guest users to access arbitrary physical memory by triggering certain mapping operations.

CVSS 2.0 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat Xen

Products

Enterprise Linux Xen

CVE-2009-3525

Xen: PyGrub missing support for password configuration command

The pyGrub boot loader in Xen 3.0.3, 3.3.0, and Xen-3.3.1 does not support the password option in grub.conf for para-virtualized guests, which allows attackers with access to the para-virtualized guest console to boot the guest or modify the guest's kernel boot parameters without providing the expected password.

CVSS 2.0 · 7.2 High EPSS 1.2% KEV · Not listed

Vendors

Redhat Xen

Products

Enterprise Linux Xen

CVE-2007-5730

QEMU Buffer overflow via crafted "net socket listen" option

Heap-based buffer overflow in QEMU 0.8.2, as used in Xen and possibly other products, allows local users to execute arbitrary code via crafted data in the "net socket listen" option, aka QEMU "net socket" heap overflow. NOTE: some sources have used CVE-2007-1321 to refer to this issue as part of "NE2000 network driver and the socket code," but this is the correct identifier for the individual net socket listen vulnerability.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Debian Qemu Redhat and 1 more

Products

Debian Linux Qemu Enterprise Linux and 1 more

CVE-2009-1758

kernel: xen: local denial of service

The hypervisor_callback function in Xen, possibly before 3.4.0, as applied to the Linux kernel 2.6.30-rc4, 2.6.18, and probably other versions allows guest user applications to cause a denial of service (kernel oops) of the guest OS by triggering a segmentation fault in "certain address ranges."

CVSS 2.0 · 5.0 Medium EPSS 2.2% KEV · Not listed

Vendors

Linux Redhat Xen

Products

Linux Kernel Enterprise Linux Xen

CVE-2026-23553

x86: incomplete IBPB for vCPU isolation

In the context switch logic Xen attempts to skip an IBPB in the case of a vCPU returning to a CPU on which it was the previous vCPU to run. While safe for Xen's isolation between vCPUs, this prevents the guest kernel correctly isolating between tasks. Consider: 1) vCPU runs on CPU A, running task 1. 2) vCPU moves to CPU B, idle gets scheduled on A. Xen skips IBPB. 3) On CPU B, guest kernel switches from task 1 to 2, issuing IBPB. 4) vCPU moves back to CPU A. Xen skips IBPB again. Now, task 2 is running on CPU A with task 1's training still in the BTB.

CVSS 3.1 · 2.9 Low EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2024-2193

Speculative Race Condition impacts modern CPU architectures that support speculative execution, also known as GhostRace.

A Speculative Race Condition (SRC) vulnerability that impacts modern CPU architectures supporting speculative execution (related to Spectre V1) has been disclosed. An unauthenticated attacker can exploit this vulnerability to disclose arbitrary data from the CPU using race conditions to access the speculative executable code paths.

CVSS 3.1 · 5.7 Medium EPSS 1.3% KEV · Not listed

Vendors

Amd Xen

Products

Cpu Xen

CVE-2026-23554

Use after free of paging structures in EPT

The Intel EPT paging code uses an optimization to defer flushing of any cached EPT state until the p2m lock is dropped, so that multiple modifications done under the same locked region only issue a single flush. Freeing of paging structures however is not deferred until the flushing is done, and can result in freed pages transiently being present in cached state. Such stale entries can point to memory ranges not owned by the guest, thus allowing access to unintended memory regions.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2026-23555

Xenstored DoS by unprivileged domain

Any guest issuing a Xenstore command accessing a node using the (illegal) node path "/local/domain/", will crash xenstored due to a clobbered error indicator in xenstored when verifying the node path. Note that the crash is forced via a failing assert() statement in xenstored. In case xenstored is being built with NDEBUG #defined, an unprivileged guest trying to access the node path "/local/domain/" will result in it no longer being serviced by xenstored, other guests (including dom0) will still be serviced, but xenstored will use up all cpu time it can get.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2022-4949

AdSanity < 1.8.2 - Authenticated Arbitrary File Upload

The AdSanity plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'ajax_upload' function in versions up to, and including, 1.8.1. This makes it possible for authenticated attackers with Contributor+ level privileges to upload arbitrary files on the affected sites server which makes remote code execution possible.

CVSS 3.1 · 8.8 High EPSS 2.2% KEV · Not listed

Vendors

Adsanityplugin Xen

Products

Adsanity Xen

CVE-2025-58150

x86: buffer overrun with shadow paging + tracing

Shadow mode tracing code uses a set of per-CPU variables to avoid cumbersome parameter passing. Some of these variables are written to with guest controlled data, of guest controllable size. That size can be larger than the variable, and bounding of the writes was missing.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2025-58149

Incorrect removal of permissions on PCI device unplug

When passing through PCI devices, the detach logic in libxl won't remove access permissions to any 64bit memory BARs the device might have. As a result a domain can still have access any 64bit memory BAR when such device is no longer assigned to the domain. For PV domains the permission leak allows the domain itself to map the memory in the page-tables. For HVM it would require a compromised device model or stubdomain to map the leaked memory into the HVM domain p2m.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2025-58148

x86: Incorrect input sanitisation in Viridian hypercalls

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Some Viridian hypercalls can specify a mask of vCPU IDs as an input, in one of three formats. Xen has boundary checking bugs with all three formats, which can cause out-of-bounds reads and writes while processing the inputs. * CVE-2025-58147. Hypercalls using the HV_VP_SET Sparse format can cause vpmask_set() to write out of bounds when converting the bitmap to Xen's format. * CVE-2025-58148. Hypercalls using any input format can cause send_ipi() to read d->vcpu[] out-of-bounds, and operate on a wild vCPU pointer.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2025-58147

x86: Incorrect input sanitisation in Viridian hypercalls

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Some Viridian hypercalls can specify a mask of vCPU IDs as an input, in one of three formats. Xen has boundary checking bugs with all three formats, which can cause out-of-bounds reads and writes while processing the inputs. * CVE-2025-58147. Hypercalls using the HV_VP_SET Sparse format can cause vpmask_set() to write out of bounds when converting the bitmap to Xen's format. * CVE-2025-58148. Hypercalls using any input format can cause send_ipi() to read d->vcpu[] out-of-bounds, and operate on a wild vCPU pointer.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2024-45819

libxl leaks data to PVH guests via ACPI tables

PVH guests have their ACPI tables constructed by the toolstack. The construction involves building the tables in local memory, which are then copied into guest memory. While actually used parts of the local memory are filled in correctly, excess space that is being allocated is left with its prior contents.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2024-31143

double unlock in x86 guest IRQ handling

An optional feature of PCI MSI called "Multiple Message" allows a device to use multiple consecutive interrupt vectors. Unlike for MSI-X, the setting up of these consecutive vectors needs to happen all in one go. In this handling an error path could be taken in different situations, with or without a particular lock held. This error path wrongly releases the lock even when it is not currently held.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2024-45817

x86: Deadlock in vlapic_error()

In x86's APIC (Advanced Programmable Interrupt Controller) architecture, error conditions are reported in a status register. Furthermore, the OS can opt to receive an interrupt when a new error occurs. It is possible to configure the error interrupt with an illegal vector, which generates an error when an error interrupt is raised. This case causes Xen to recurse through vlapic_error(). The recursion itself is bounded; errors accumulate in the the status register and only generate an interrupt when a new status bit becomes set. However, the lock protecting this state in Xen will try to be taken recursively, and deadlock.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2025-1713

deadlock potential with VT-d and legacy PCI device pass-through

When setting up interrupt remapping for legacy PCI(-X) devices, including PCI(-X) bridges, a lookup of the upstream bridge is required. This lookup, itself involving acquiring of a lock, is done in a context where acquiring that lock is unsafe. This can lead to a deadlock.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2025-27465

x86: Incorrect stubs exception handling for flags recovery

Certain instructions need intercepting and emulating by Xen. In some cases Xen emulates the instruction by replaying it, using an executable stub. Some instructions may raise an exception, which is supposed to be handled gracefully. Certain replayed instructions have additional logic to set up and recover the changes to the arithmetic flags. For replayed instructions where the flags recovery logic is used, the metadata for exception handling was incorrect, preventing Xen from handling the the exception gracefully, treating it as fatal instead.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Xen

Products

Xen

CVE-2023-46839

pci: phantom functions assigned to incorrect contexts

PCI devices can make use of a functionality called phantom functions, that when enabled allows the device to generate requests using the IDs of functions that are otherwise unpopulated. This allows a device to extend the number of outstanding requests. Such phantom functions need an IOMMU context setup, but failure to setup the context is not fatal when the device is assigned. Not failing device assignment when such failure happens can lead to the primary device being assigned to a guest, while some of the phantom functions are assigned to a different domain.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Xen

Products

Fedora Xen