Skip to main content

Xen CVE-2026-62433

| EUVDEUVD-2026-49786 HIGH
Improper Initialization (CWE-665)
2026-07-28 security@xen.org GHSA-cfmp-p477-x9qv
Information Disclosure Suse
7.3
CVSS 3.1 · Vendor: xen
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain control of a device model domain
  2. Exploit
    Craft DM_OP call with too few buffers
  3. Execution
    Hypervisor reads uninitialized structures
  4. Impact
    Leak hypervisor stack memory

Vulnerability Assessment

Weakness
CWE
CWE-665
Exploitation Conditions

Exploitation requires the ability to issue DM_OP (device model) hypercalls against the Xen hypervisor - i.e., the attacker must control or compromise a device model / emulator component (typically QEMU in a control or stub domain) for an HVM or PVH guest; it is not reachable by an ordinary unprivileged guest through normal guest operation, nor by a purely network-based unauthenticated actor despite the AV:N/PR:N CVSS vector. The triggering condition is invoking a DM_OP operation while supplying fewer than the required number of buffers, so that unvalidated, uninitialized structures are read. Limiting factors: the host must run HVM/PVH guests with a device model, the attacker needs the privilege level associated with running that device model, and the impact is confined to disclosure of low-value uninitialized stack memory rather than direct code execution.
Impact

Signals are largely consistent toward low-to-moderate real-world urgency. The published CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:L/I:L/A:L, base 7.3) reads high, but it appears inconsistent with the description: DM_OP is a privileged hypercall issued by a device model, not a network-facing, unauthenticated surface - verify with the Xen advisory, as the practical vector is local and privileged rather than AV:N/PR:N. SSVC classifies exploitation as none, automatable as yes, and technical impact as partial, and EPSS is low (0.26%). The primary consequence is disclosure of uninitialized stack memory (Xen's own tag is 'Information Disclosure'), which is opportunistic rather than a clean, targeted leak. There is no KEV listing and no identified public exploit. Net: a legitimate hygiene/patch item for multi-tenant virtualization hosts, but not an emergency; the headline 7.3 overstates real risk relative to the description and SSVC/EPSS signals.
Exploit ScenarioDerived

An attacker who controls or has compromised a device model (e.g., a QEMU stub domain serving an HVM guest) issues a crafted DM_OP hypercall that supplies fewer buffers than the target operation expects; the hypervisor proceeds without validation and returns data derived from uninitialized stack structures, leaking fragments of hypervisor memory. Repeating the call can accumulate leaked stack contents that may aid further attacks. No public proof-of-concept is currently identified.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 30, 2026

Information disclosure in the Xen hypervisor's DM_OP (device model operation) hypercall handling allows a device model caller to leak uninitialized hypervisor stack memory because certain operations do not verify that the required number of buffers was supplied before reading them. Affected Xen builds process DM_OP requests using structures that may remain uninitialized ('stack rubble'), disclosing low-value memory contents (CWE-665) with limited integrity and availability side effects. No public exploit has been identified at time of analysis; SSVC records exploitation status as none, EPSS is low (0.26%, 18th percentile), and it is not on CISA KEV.

RemediationAI

Apply the patches published in Xen Project advisory XSA-506 (https://xenbits.xenproject.org/xsa/advisory-506.html), which add the missing buffer-count checks in the DM_OP dispatch path; the advisory carries the per-branch patch set and any tagged releases - Patch available per vendor advisory (exact fix version not enumerated in the provided data, confirm against XSA-506 for your Xen branch). Rebuild/redeploy the hypervisor and restart the affected hosts (typically requiring guest migration or a maintenance window) to load the corrected hypervisor. Where immediate patching is not possible, reduce exposure by ensuring device models run deprivileged in stub domains (dm_restrict) so a compromised or buggy device model cannot leverage the leak beyond its own domain, and limit which domains are permitted to act as device models; note these controls reduce blast radius but do not close the underlying missing-check flaw. See also the oss-security disclosure at https://seclists.org/oss-sec/2026/q3/310.

Affected ProductsAI

The Xen hypervisor is affected wherever the DM_OP handling code lacks buffer-count validation; the Xen Project advisory XSA-506 (https://xenbits.xenproject.org/xsa/advisory-506.html and mirror http://xenbits.xen.org/xsa/advisory-506.html) is the authoritative source for the exact affected version ranges and patched releases, which are not enumerated in the provided intelligence (no CPE strings were supplied). This is also tracked as ENISA EUVD EUVD-2026-49786 and VulDB entry https://vuldb.com/vuln/383868. Deployments running HVM/PVH guests with a device model (QEMU) are in scope; consult XSA-506 to map the fix against your specific Xen version.

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Xen is a bare-metal (type-1) hypervisor widely used for server and cloud virtualization. DM_OP is the hypercall interface through which a device model (the emulator component, typically QEMU running in a control or stub domain) requests emulation-related services from the hypervisor for HVM/PVH guests. The interface passes a set of caller-provided buffers, and the hypervisor is supposed to validate that the count and sizes match the requested operation. The root cause maps to CWE-665 (Improper Initialization): parts of the DM_OP dispatch path trust the caller to supply the correct number of buffers and skip the check, so operations dereference or copy from structures that were never populated, exposing residual hypervisor stack data. The vendor (Xen Project) tracks this as XSA-506.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (xen) PRIMARY 7.3 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
vuln.today AI 3.8 LOW

DM_OP is a local privileged hypercall from a device model (AV:L/PR:L); a device model reading hypervisor memory crosses a trust boundary (S:C); impact is limited stack-memory disclosure only (C:L, I:N/A:N).

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
SUSE 5.9 MEDIUM
AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

Primary rating from Vendor (xen).

CVSS VectorVendor: xen

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
Low

Lifecycle Timeline

2
CVE Published
Jul 28, 2026 - 13:19 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 28, 2026 - 13:19 cve.org
HIGH 7.3

DescriptionCVE.org

Parts of the DM_OP handling code assumes the caller has provided the required number of buffers for the given operation without any checking being done. As a result, certain operations might access stack rubble as structures are possibly uninitialized.

Executive ViewAI

Why It Matters

CVE-2026-62433 is a confidentiality risk in Xen hypervisor environments that could allow device model processes to access sensitive data resident in hypervisor memory. For organizations using Xen for cloud services, virtualization platforms, or multi-tenant infrastructure, this represents a data protection exposure affecting the trust boundary between isolated workloads. While no active exploitation has been observed, the lack of an available patch requires immediate mitigation to maintain data isolation controls.

Business Impact: High
Compensating Controls

Restrict DM_OP hypercall access to trusted, isolated device models; disable unnecessary device model operations and vdev types not required for production workloads; enforce network segmentation to limit exposure of affected hypervisors; implement detailed audit logging and monitoring for DM_OP invocations; maintain separate Xen instances or domains for high-sensitivity and untrusted workloads with minimal device model exposure. No vendor-released patch identified at time of analysis.

Threat Intelligence Overview

EPSS Score
0.3%
Top 82% exploitable
Prevalence
High
Xen underpins many enterprise and cloud virtualization deployments
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.3%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

36
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-665 – Improper Initialization

View all
CVE-2022-0847 HIGH POC
7.8
CVE-2013-1675 MEDIUM POC
6.5
CVE-2023-1719 CRITICAL POC
9.8
CVE-2022-36061 CRITICAL POC
9.8
CVE-2022-37128 CRITICAL POC
9.8
CVE-2019-20063 HIGH POC
8.8
CVE-2017-13715 CRITICAL
9.8
CVE-2020-11655 HIGH POC
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS Fixed
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS Fixed
SUSE Linux Enterprise Micro 5.3 Fixed

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-62433 ADVISORY https://seclists.org/oss-sec/2026/q3/310 ADVISORY https://vuldb.com/vuln/383868 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3409/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3423/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3451/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:3462/ REF http://www.openwall.com/lists/oss-security/2026/07/28/22 REF http://xenbits.xen.org/xsa/advisory-506.html REF https://xenbits.xenproject.org/xsa/advisory-506.html

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy