Skip to main content

Xen PV Drivers EUVDEUVD-2025-210444

| CVE-2025-27463 CRITICAL
Incorrect Default Permissions (CWE-276)
2026-07-09 XEN GHSA-j273-68h8-x289
Privilege Escalation Microsoft Xen Suse Windows Pv Drivers
Critical
Disputed · 9.4 Vendor: XEN
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (XEN) PRIMARY
9.4 CRITICAL
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
8.8 HIGH

Requires an existing local user session so PR:L, low complexity, and a scope change (S:C) as guest-user access reaches kernel/hypervisor-facing facilities with full CIA impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
SUSE
MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: XEN

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Jul 09, 2026 - 16:33 vuln.today
CVE Published
Jul 09, 2026 - 14:29 cve.org
CRITICAL 9.4

DescriptionCVE.org

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windows PV drivers expose various facilities to userspace. Several of these have no security descriptor, and are therefore fully accessible to unprivileged users. These are: 1. XenCons, CVE-2025-27462 2. XenIface, CVE-2025-27463 3. XenBus, CVE-2025-27464

AnalysisAI

Local privilege escalation in Xen's Windows PV (paravirtualized) drivers arises because the XenIface interface is exposed to userspace with no security descriptor, leaving it fully accessible to unprivileged users. Any low-privileged local user on an affected Windows guest can interact with this facility to gain elevated control over the system. This is one of three sibling issues (alongside CVE-2025-27462 XenCons and CVE-2025-27464 XenBus) disclosed in Xen Security Advisory XSA-468; no public exploit has been identified at time of analysis.

Technical ContextAI

Xen Windows PV drivers are paravirtualized device drivers installed inside Windows guest VMs running on the Xen hypervisor, providing high-performance virtual disk, network, and management interfaces between the guest and host. XenIface specifically is the interface/management driver that brokers communication between userspace tooling and the hypervisor via the Xen store and shared facilities. The root cause is CWE-276 (Incorrect Default Permissions): the driver creates its device object (interface exposed to userspace) without attaching a security descriptor/ACL, so the Windows object manager applies overly permissive default access, allowing any authenticated non-administrative user to open and issue IOCTLs to a driver that operates at kernel/SYSTEM privilege. Affected component per CPE is cpe:2.3:a:xen:windows_pv_drivers.

RemediationAI

Apply the fixed Xen Windows PV driver packages published under Xen Security Advisory XSA-468 (https://xenbits.xen.org/xsa/advisory-468.html), which add proper security descriptors restricting the XenIface, XenCons, and XenBus device interfaces to privileged callers; exact patched version strings are not provided in this intelligence set and must be read from the advisory. No vendor-released patch version is independently confirmed here beyond the advisory reference. As a compensating control until drivers are updated, restrict interactive and remote logon on affected Windows guests to trusted administrators only (this defect requires a local user session, so limiting who can run code in the guest directly reduces exposure), and where operationally acceptable tighten the driver device object ACLs or remove/disable unused PV facilities - with the trade-off that disabling PV management interfaces can degrade guest tooling, monitoring, and performance features. Prioritize patching guests that permit untrusted or multi-tenant local users.

More in Xen

View all
CVE-2012-0217 HIGH POC
7.2 Jun 12

The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and

CVE-2015-3456 HIGH POC
7.7 May 13

The Floppy Disk Controller (FDC) in QEMU, as used in Xen 4.5.x and earlier and KVM, allows local guest users to cause a

CVE-2018-8897 HIGH POC
7.8 May 08

A statement in the System Programming Guide of the Intel 64 and IA-32 Architectures Software Developer's Manual (SDM) wa
CVE-2022-4949 HIGH POC
8.8 Jun 07

The AdSanity plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'aj
CVE-2017-15595 HIGH POC
8.8 Oct 18

An issue was discovered in Xen through 4.9.x allowing x86 PV guest OS users to cause a denial of service (unbounded recu
CVE-2017-7228 HIGH POC
8.2 Apr 04

An issue (known as XSA-212) was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. Rated
CVE-2015-5165 CRITICAL
9.3 Aug 12

The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows
CVE-2015-8550 HIGH
8.2 Apr 14

Xen, when used on a system providing PV backends, allows local guest OS administrators to cause a denial of service (hos
CVE-2022-26364 MEDIUM POC
6.7 Jun 09

x86 pv: Insufficient care with non-coherent mappings T[his CNA information record relates to multiple CVEs; the text exp
CVE-2017-10918 CRITICAL
10.0 Jul 05

Xen through 4.8.x does not validate memory allocations during certain P2M operations, which allows guest OS users to obt
CVE-2017-10912 CRITICAL
10.0 Jul 05

Xen through 4.8.x mishandles page transfer, which allows guest OS users to obtain privileged host OS access, aka XSA-217
CVE-2017-10921 CRITICAL
10.0 Jul 05

The grant-table feature in Xen through 4.8.x does not ensure sufficient type counts for a GNTMAP_device_map and GNTMAP_h

Same weakness CWE-276 – Incorrect Default Permissions

View all
CVE-2013-0632 CRITICAL POC
9.8
CVE-2017-11610 HIGH POC
8.8
CVE-2022-22948 MEDIUM POC
6.5
CVE-2017-8625 HIGH POC
8.8
CVE-2016-5425 HIGH POC
7.8
CVE-2024-55215 CRITICAL POC
9.8
CVE-2024-57604 CRITICAL POC
9.8
CVE-2024-28056 CRITICAL POC
9.8

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Micro 5.3 Not-Affected
SUSE Linux Enterprise Micro 5.4 Not-Affected
SUSE Linux Enterprise Micro 5.5 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP4 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS Not-Affected

Share

EUVD-2025-210444 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy