EUVD-2026-72720
GHSA-626m-h7vc-vwvc
Severity by source
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
AV:L and PR:L reflect guest-local access; S:C and high impacts consistent with hypervisor escape potential via CWE-119; AC:L once passthrough is configured.
Primary rating from Vendor (XEN).
CVSS VectorVendor: XEN
Lifecycle Timeline
4DescriptionCVE.org
A guest with a PCI device assigned that has at least a BAR on the IO port space can trigger a BUG() in Xen.
AnalysisAI
Guest-to-hypervisor privilege escalation in Xen allows a VM guest with a PCI device assigned - where the device exposes at least one Base Address Register (BAR) mapped to IO port space - to trigger a BUG() assertion in the Xen hypervisor, crashing or potentially compromising the host. The CVSS scope-changed vector (S:C, C:H/I:H/A:H) reflects cross-boundary impact: the attack originates inside a guest VM but affects the host hypervisor. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | PCI device passthrough must be configured and the assigned PCI device must expose at least one BAR mapped to the IO port space - this is not a default Xen configuration and requires explicit administrator setup. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) correctly reflects a scope-changed guest-escape class of vulnerability: low complexity once the preconditions are met, requiring only low-privilege guest access to the assigned PCI device. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the patches provided in XSA-510, available at https://xenbits.xenproject.org/xsa/advisory-510.html. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all Xen hosts and audit which virtual machines have PCI device pass-through enabled, prioritizing hosts running untrusted or multi-tenant workloads. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and
The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a
A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) wa
The AdSanity plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'aj
An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to cause a denial of service (unbounded recu
An issue (known as XSA-212) was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. Rated
The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows
Xen, when used on a system providing PV backends, allows local guest OS administrators to cause a denial of service (hos
x86 pv: Insufficient care with non-coherent mappings T[his CNA information record relates to multiple CVEs; the text exp
Xen through 4.8.x does not validate memory allocations during certain P2M operations, which allows guest OS users to obt
Xen through 4.8.x mishandles page transfer, which allows guest OS users to obtain privileged host OS access, aka XSA-217
The grant-table feature in Xen through 4.8.x does not ensure sufficient type counts for a GNTMAP_device_map and GNTMAP_h
Same weakness CWE-119 – Buffer Overflow
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today