CVE-2026-62425
Received Received - Intake

Buffer Overflow in libfsimage ISO9660 Driver

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: Xen Project

Description
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them: * The directory loop itself assumes a good record length. This is CVE-2026-42494. * The calculation of the System Use area may underflow. This is CVE-2026-42495. * The Rock Ridge extension loop assumes a good (inner) record length. This is CVE-2026-62423. * The Rock Ridge NM record processing assumes a good entry length. This is CVE-2026-62424. * The Rock Ridge CE record processing assumes a good size and offset. This is CVE-2026-62425.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-62425
EUVD
EUVD-2026-49776

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
xen xen From 3.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-62425 is a buffer overrun vulnerability in Xen's libfsimage library when processing ISO9660 filesystems. It involves the Rock Ridge CE record handling where attacker-controlled on-disk fields are used to derive lengths without validation, potentially causing underflow conditions.

Detection Guidance

Detection involves checking for vulnerable Xen versions and configurations. Review system logs for pygrub usage and ISO9660 filesystem handling. No direct commands are provided in the resources, but monitoring for privilege escalation attempts in domain construction tools may indicate exploitation.

Impact Analysis

An attacker could exploit this to escalate privileges from a guest using pygrub to the level of domain construction tools, potentially gaining control of the host system. This requires the guest to use pygrub for booting.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a technical flaw in the Xen hypervisor's handling of ISO9660 filesystems. However, if exploited, it could lead to unauthorized privilege escalation, potentially compromising data confidentiality and integrity, which may indirectly impact compliance with data protection regulations.

Mitigation Strategies

Immediately switch to de-privileged pygrub mode (XSA-443), avoid using pygrub entirely, or use alternative bootloaders like pvgrub for 64-bit PV guests with grub2. Apply the available patch to resolve the issue. Deployment of mitigations is permitted during the embargo period.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62425. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart