EUVD-2025-210445
GHSA-jmgg-9rvf-m69w
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain unprivileged local account on Windows guest
-
DeliveryOpen unprotected XenBus device interface
-
ExploitIssue crafted requests over privileged channel
-
ExecutionEscalate to SYSTEM / cross guest-hypervisor boundary
-
ImpactFull compromise of guest
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V13 - Configuration Default permission hardening
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires local access to a Windows guest that has the vulnerable Xen PV drivers installed; the attacker must be able to run code as any user, but no elevated privileges (PR:N) and no user interaction (UI:N) are needed because the XenBus device interface is created with no security descriptor and is therefore openable by unprivileged users by default. Limiting factors: the flaw is not network-reachable (AV:L) so the attacker needs an existing local foothold on the guest, and only systems running the affected xen:windows_pv_drivers are exposed - hosts without these PV drivers, or with the XSA-468 fixed builds that add ACLs, are not affected. |
| Impact | The supplied CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N, VC/VI/VA:H and SC/SI/SA:H, base 9.4) describes a locally-reachable but very high-impact flaw: no privileges, no user interaction, and full confidentiality/integrity/availability impact to both the vulnerable and subsequent systems, consistent with escalation across the guest-to-hypervisor trust boundary. The critical caveat is attack vector: this requires LOCAL access to a Windows guest (AV:L) - it is not remotely reachable, which materially lowers real-world exploitability versus the headline 9.4. No EPSS score, KEV listing, or POC signal was provided, so there is no evidence of active or automated exploitation; the risk is a credible, high-severity local privilege-escalation primitive rather than a mass-exploited remote bug. Given the missing-ACL root cause, exploitation is likely reliable once local guest access is obtained, so this should be prioritized for patching on any multi-tenant or shared Xen Windows guest even though it is not internet-facing. |
| Exploit ScenarioDerived | An attacker who already has an unprivileged foothold on a Windows guest (e.g., a low-privileged local user, a compromised service account, or a tenant in a shared VDI/cloud environment) opens the unprotected XenBus device interface, which Windows permits due to the missing security descriptor. By issuing crafted requests over this privileged channel, they escalate to SYSTEM-level control of the guest and reach the paravirtualized host-communication path. No public exploit is identified at time of analysis, but the missing-ACL root cause makes reliable local exploitation plausible. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 09, 2026
Local privilege escalation in Xen's Windows PV (paravirtualized) drivers arises because the XenBus interface (CVE-2025-27464) is exposed to userspace with no security descriptor, leaving it fully accessible to any unprivileged user on a Windows guest. Because XenBus mediates communication between the guest and the hypervisor's device backend, an unprivileged local user can abuse this open interface to gain elevated privileges and potentially impact the guest and the virtualization layer. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it is documented in Xen Security Advisory XSA-468.
RemediationAI
Patch available per vendor advisory: apply the fixed Windows PV driver builds referenced in Xen Security Advisory XSA-468 (https://xenbits.xen.org/xsa/advisory-468.html), which adds proper security descriptors/ACLs to the exposed device interfaces. Because all three interfaces (XenBus, XenIface, XenCons) share the same incorrect-permissions root cause, update the full PV driver package rather than a single component. Where immediate patching is not possible, compensating controls include limiting who can obtain interactive/local logon on Windows guests (restrict local accounts and RDP to trusted admins), avoiding placing untrusted or multi-tenant workloads on affected guests, and - if operationally acceptable - restricting or tightening access to the affected Xen device objects; note the trade-off that hardening or removing these interfaces can break paravirtualized device functionality and degrade guest performance. No exact fixed version string was supplied in the input, so verify the target build directly against XSA-468 before deployment.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Xen PV drivers are paravirtualized device drivers installed inside a Windows guest running on a Xen-based hypervisor; they replace emulated hardware with fast, direct channels to the Xen backend. XenBus is the core driver that manages the shared 'store' and event/grant plumbing used to connect guest frontends to host backends, so it is a privileged bridge between userspace and the hypervisor boundary. The root cause is CWE-276 (Incorrect Default Permissions): the device objects XenBus (and sibling interfaces XenCons/CVE-2025-27462 and XenIface/CVE-2025-27463) expose to userspace are created without any security descriptor/ACL, so Windows applies overly permissive default access and any unprivileged user can open and issue requests to a channel intended for privileged code. The affected component per CPE is cpe:2.3:a:xen:windows_pv_drivers.
Know when Windows Pv Drivers gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Any unprivileged local user can open the ACL-less XenBus interface (AV:L, PR:N, UI:N), and escalation crosses the guest/hypervisor trust boundary with full impact, giving S:C and C/I/A:H.
Primary rating from Vendor (XEN).
CVSS VectorVendor: XEN
DescriptionCVE.org
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windows PV drivers expose various facilities to userspace. Several of these have no security descriptor, and are therefore fully accessible to unprivileged users. These are: 1. XenCons, CVE-2025-27462 2. XenIface, CVE-2025-27463 3. XenBus, CVE-2025-27464
Executive ViewAI
Xen Windows PV drivers (CVE-2025-27464) contain a critical local privilege escalation vulnerability in the XenBus interface that allows unprivileged guest users to gain elevated privileges and potentially access the hypervisor. Organizations running Windows virtual machines on Xen infrastructure face immediate risk to guest isolation and hypervisor integrity, particularly in multi-tenant or untrusted workload scenarios. No vendor patch is currently available, requiring urgent interim containment and continuous monitoring.
No vendor-released patch identified at time of analysis. Interim mitigations include: (1) Enforce least-privilege and disable unnecessary administrative rights on guest operating systems; (2) enable process and privilege escalation auditing on Windows guests to detect exploitation attempts; (3) isolate guest workloads suspected of running untrusted code or hosting multiple customer tenants to dedicated physical hosts; (4) restrict and monitor all administrative account usage and interactive logons; (5) coordinate directly with Xen vendor for XSA-468 release and patch deployment procedures. Regularly monitor Xen security advisories for patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
More in Windows Pv Drivers
View allLocal privilege escalation in the Xen Windows PV Drivers (the XenCons paravirtualized console interface) lets any unpriv
Local privilege escalation in Xen's Windows PV (paravirtualized) drivers arises because the XenIface interface is expose
Exploit-DB