Xen Windows PV Drivers CVE-2025-27462

Exploitation requires local code execution inside a Windows guest that has the Xen PV Drivers installed, specifically the XenCons console interface whose device object is created without a security descriptor and is therefore reachable by any unprivileged user account. The concrete prerequisite is: the target must be a Windows VM running on Xen with these PV drivers present, and the attacker must already have some unprivileged local presence (a logged-in user account or a foothold process) in that guest. Limiting factors: it is not remotely exploitable over the network (AV:L), it does not affect Windows guests without the Xen PV drivers, and it provides no benefit to an attacker who has no local access to the guest; conversely, no administrative rights, user interaction, or non-default configuration are needed once local access exists, since the interface is exposed by default.

The XEN-supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, base 9.4) is internally consistent with a missing-ACL local privilege escalation: exploitation is local (AV:L), needs low complexity and no user interaction, and the high subsequent-system metrics reflect escalation beyond the vulnerable component into the guest OS. Note the tension in privileges: the vector uses PR:N, yet the flaw is a privilege escalation that inherently requires the attacker to already be a local, logged-in unprivileged user - so realistic exploitation does require prior local access, which materially limits blast radius versus a remote-network flaw. No EPSS score, SSVC decision, POC, or KEV entry was provided, so the automatable/exploitation-maturity signals are unknown; absence of these is not evidence of low risk but does mean there is no confirmation of active or automated exploitation. Overall this is a genuinely high-severity local-EP issue for any Windows guest running Xen PV drivers, but the local-only vector makes it a serious hardening/patch priority rather than an emergency internet-facing exposure.

A low-privileged user (or a compromised low-privilege service/process) on a Windows guest running Xen PV drivers opens the unprotected XenCons device object that lacks a security descriptor, and uses the exposed console facility to influence privileged operations and escalate to full guest compromise. Because the CVSS vector is AV:L/AC:L/PR:N/UI:N, no social engineering or complex preconditions are needed once the attacker has any local foothold. No public exploit identified at time of analysis, so an attacker would need to develop tooling against the interface.