Xen Hypervisor CVE-2025-58148

Exploitation realistically requires the attacker to already control a guest domain on an affected Xen host (XSA-475); the described memory disclosure is a hypervisor-level out-of-bounds read reached from guest-triggered operations, not from an external network service. Limiting factors: attacker must hold guest execution on the vulnerable host, the host must run an affected unpatched Xen version (Alpine builds before xen 4.20.1-r2), and impact is confined to information disclosure (no integrity or availability impact). NOTE: the input CVSS labels this AV:N/PR:N (remote/unauthenticated), which contradicts the guest-local nature of Xen hypervisor flaws - defenders should confirm the true attack surface against XSA-475 before treating it as network-reachable.

Signals are moderate and partly conflicting. The provided CVSS 3.1 vector (7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) describes a network, unauthenticated, confidentiality-only flaw, consistent with CWE-125 out-of-bounds read and the 'Information Disclosure' tag. However, this is a Xen hypervisor vulnerability (XSA-475) and the one-line description ('Alpine Linux: xen fixed in 4.20.1-r2') gives no triggering detail - Xen security issues are overwhelmingly reachable by a malicious or compromised guest VM (local/adjacent), NOT by an anonymous network attacker, so the AV:N/PR:N labeling is very likely an NVD over-broadening and should be verified against XSA-475. EPSS is low (0.36%, 28th percentile), there is no CISA KEV listing and no public POC identified, so there is no evidence of active or imminent exploitation. Net: this is a credible info-disclosure bug in a hypervisor (memory from host/other guests potentially leaking), worth patching on virtualization hosts, but it is not an emergency - the headline 7.5 'network/unauthenticated' framing likely overstates real-world reachability, and a leak-only (C:H, I:N, A:N) issue does not grant code execution or takeover on its own.

An attacker who controls a guest VM on a shared Xen host issues a crafted operation that triggers the out-of-bounds read, causing the hypervisor to return memory contents belonging to the host or to co-located tenants. Repeated reads could harvest secrets (keys, tokens, other-guest data) in a multi-tenant environment. No public exploit code is available, and the low CVSS attack complexity suggests the trigger itself is straightforward once guest access is held.