Xen Hypervisor EUVD-2026-42608

Exploitation requires the attacker to already possess execution within a Xen guest domain on an affected host - this is a local (AV:L) guest-to-host escape, not remotely reachable, which is the primary limiting factor. In multi-tenant or hostile-guest environments (public cloud, VPS, malware-analysis sandboxes) this prerequisite is trivially met because guests are attacker-controlled by design; in single-tenant deployments running only trusted workloads the practical exposure is much lower. The specific guest-triggerable operation and any required hardware or Xen build/configuration settings are defined in XSA-489 (CVE-2026-42486 is one of several bundled RB-subsystem issues) and should be checked against your deployment; the official vector lists PR:N and UI:N, so no in-guest privilege or user interaction is claimed beyond having a guest foothold.

The published CVSS 4.0 score is 9.4 (Critical) with vector AV:L/AC:L/AT:N/PR:N/UI:N and high vulnerable- and subsequent-system impact (VC/VI/VA:H, SC/SI/SA:H), reflecting a guest-to-host isolation breach with low complexity and no user interaction. The attack vector is Local (AV:L), so this is not a remotely reachable network flaw - the attacker must already have code execution inside a guest, which meaningfully limits opportunistic mass exploitation. There is no EPSS score, no SSVC decision, no POC, and no KEV listing provided, so exploitation appears theoretical/coordinated-disclosure at this stage rather than actively exploited. Note a discrepancy worth verifying with the vendor: the official vector states PR:N, but realistic exploitation requires the attacker to control a guest domain, which many analysts would model as PR:L - this affects prioritization for multi-tenant environments where any guest is attacker-controlled by design.

An attacker who has already gained code execution inside a Xen guest VM - for example through a purchased cloud instance or a compromised tenant - invokes the vulnerable hypervisor operation to escape guest isolation and execute with host-level privilege. Because the CVSS complexity is low (AC:L) and no user interaction is required, a successful trigger from within the guest yields control over the host and, by extension, other co-resident guests. No public POC is currently identified.