Xen PV Drivers CVE-2025-27463

Exploitation requires an existing local user session on a Windows guest VM that has the affected Xen PV drivers installed, and specifically that the XenIface device interface is present and exposed without a security descriptor (its default vulnerable state). What limits exploitation: it is not remotely reachable (AV:L) - the attacker must already run code as some local user in the guest; it applies only to Windows guests running Xen PV drivers, not to bare-metal Windows or other hypervisors; and guests where only trusted administrators can log on have a far smaller realistic attack surface. No additional authentication beyond a normal user account and no user interaction are needed once local access is held.

The supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N, VC/VI/VA:H and SC/SI/SA:H, base 9.4) indicates a low-complexity, local, unauthenticated-at-the-user-tier attack with high impact on both the vulnerable guest and subsequent systems, consistent with escalation from an unprivileged guest user toward SYSTEM/hypervisor-adjacent control. The attack vector is LOCAL, not network, so this is not remotely exploitable and not mass-exploitable at internet scale - it requires an attacker to already have code execution as a normal user inside the Windows guest. There is no EPSS score, no CISA KEV listing, and no SSVC decision data in the provided intelligence; no public exploit is identified at time of analysis, so real-world exploitation appears theoretical/unproven despite the high CVSS. Note a tension worth verifying: the vector uses PR:N, but exploitation genuinely requires the attacker to already be a logged-in local user of the guest, so the practical prerequisite is 'any local user' rather than true zero-privilege access.

An attacker who has obtained an ordinary unprivileged user session inside a Windows VM running Xen PV drivers opens the unprotected XenIface device and issues crafted IOCTLs that the driver processes with kernel privileges, escalating to SYSTEM within the guest and manipulating hypervisor-facing facilities. Because attack complexity is low and no user interaction is required, the technique is reliable once local access exists. No public proof-of-concept has been identified at time of analysis.