Skip to main content

Xen CVE-2026-42495

| EUVDEUVD-2026-49773 MEDIUM
Integer Underflow (CWE-191)
2026-07-28 security@xen.org GHSA-5rvw-g8r8-hfmx
Information Disclosure Integer Overflow Suse
5.5
CVSS 3.1 · Vendor: xen
Share

Severity by source

Vendor (xen) PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

User interaction required, no special attack requirements, high availability impact only.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:R/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
8.1 HIGH
AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (xen).

CVSS VectorVendor: xen

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Analysis Generated
Jul 28, 2026 - 16:47 vuln.today
CVE Published
Jul 28, 2026 - 13:18 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.]

The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them:

  • The directory loop itself assumes a good record length. This is

CVE-2026-42494.

  • The calculation of the System Use area may underflow. This is

CVE-2026-42495.

  • The Rock Ridge extension loop assumes a good (inner) record length.

This is CVE-2026-62423.

  • The Rock Ridge NM record processing assumes a good entry length.

This is CVE-2026-62424.

  • The Rock Ridge CE record processing assumes a good size and offset.

This is CVE-2026-62425.

AnalysisAI

Integer underflow in the System Use area calculation of libfsimage's ISO 9660 driver allows denial of service via a crafted ISO image. An unauthenticated local attacker can cause the driver to crash when a user or process mounts or accesses a malicious ISO file, resulting in high availability impact. No active exploitation or public exploit has been identified at this time, and CVSS 5.5 with local attack vector and user interaction limits real-world risk.

Technical ContextAI

The vulnerability is an integer underflow (CWE-191) in the Rock Ridge/SUSP System Use area calculation within libfsimage's ISO 9660 filesystem parser. libfsimage is a library used by the Xen hypervisor for reading filesystem images, commonly employed during boot or for accessing CD/DVD images. Affected products include Xen versions prior to the XSA-497 patch; the exact version range is detailed in the Xen advisory. The root cause is a failure to validate attacker-controlled on-disk fields, leading to an underflow that crashes the driver.

Affected ProductsAI

Xen hypervisor versions using libfsimage that include the ISO 9660 driver, specifically versions prior to the release of Xen Security Advisory XSA-497. The advisory is available at https://xenbits.xenproject.org/xsa/advisory-497.html. CPE strings for affected products are not directly provided, but Xen installations with libfsimage enabled for ISO handling are impacted.

RemediationAI

Apply the vendor-released patch from Xen Security Advisory XSA-497. Update to the patched version of Xen or the libfsimage component as specified in the advisory. As a workaround, avoid mounting or accessing untrusted ISO images in environments where Xen is used. Restrict local access to trusted users to prevent the delivery of malicious ISO files. There are no known side effects to the patch beyond normal compatibility updates.

Same weakness CWE-191 – Integer Underflow

View all
CVE-2014-0497 CRITICAL POC
9.8
CVE-2015-5212 MEDIUM
6.8
CVE-2017-14496 HIGH POC
7.5
CVE-2014-8768 MEDIUM POC
5.0
CVE-2017-11757 CRITICAL POC
9.8
CVE-2024-23313 CRITICAL POC
9.8
CVE-2021-3323 CRITICAL POC
9.8
CVE-2021-21811 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Fixed
SUSE Linux Enterprise Micro 5.3 Fixed

Share

CVE-2026-42495 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy