CVE-2026-62433
Received Received - Intake

Memory Corruption in Xen Hypervisor via DM_OP

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: Xen Project

Description
Parts of the DM_OP handling code assumes the caller has provided the required number of buffers for the given operation without any checking being done. As a result, certain operations might access stack rubble as structures are possibly uninitialized.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-28
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-62433
EUVD
EUVD-2026-49786

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
xen xen From 4.10 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves incorrect buffer checks in DM_OP hypercalls in Xen. The code fails to verify if callers provide the required number of buffers for operations, leading to potential access of uninitialized stack memory. This could allow a device model of an HVM guest to inspect Xen stack contents, potentially leaking data from other guest contexts.

Detection Guidance

Detection requires checking Xen version and configuration. Run 'xl info' to verify Xen version (4.10 or later). Inspect DM_OP handling logs for unusual memory access patterns. No direct commands detect exploitation but monitoring for stack corruption or guest data leaks may indicate issues.

Impact Analysis

If exploited, this vulnerability could allow an attacker controlling an HVM guest to access sensitive data from other guest contexts by inspecting Xen stack contents. This may lead to information disclosure or unauthorized data access.

Compliance Impact

This vulnerability could lead to data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Unauthorized data access or leakage could result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Immediately switch to PV or PVH guests if using HVM. Apply the provided patch for your Xen version. Avoid running device models in stub domains or de-privileged Dom0. If patches are unavailable, consider upgrading to a supported stable branch before applying fixes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62433. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart