GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-62433 (GCVE-0-2026-62433)

Vulnerability from cvelistv5 – Published: 2026-07-28 12:32 – Updated: 2026-07-28 16:33
VLAI
Title
correct buffer checks for DM_OP hypercalls
Summary
Parts of the DM_OP handling code assumes the caller has provided the required number of buffers for the given operation without any checking being done. As a result, certain operations might access stack rubble as structures are possibly uninitialized.
Severity
7.3 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
SSVC
Exploitation: none Automatable: yes Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-07-28 15:03 UTC
CWE
  • CWE-665 - Improper Initialization
Assigner
References
Impacted products
Vendor Product Version CPE status
Xen Xen Unknown: consult Xen advisory XSA-506
guessed Create a notification for this product.
Date Public
2026-07-28 12:00
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-07-28T16:33:33.573Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://xenbits.xen.org/xsa/advisory-506.html"
          },
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/07/28/22"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "LOW",
              "baseScore": 7.3,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "LOW",
              "integrityImpact": "LOW",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-62433",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-28T15:03:57.527525Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-665",
                "description": "CWE-665 Improper Initialization",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-28T15:06:29.391Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "product": "Xen",
          "vendor": "Xen",
          "versions": [
            {
              "status": "unknown",
              "version": "consult Xen advisory XSA-506"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "All Xen versions from 4.10 onwards are vulnerable.  Xen versions 4.9 and\nearlier are not vulnerable.\n\nOnly entities controlling HVM guests can leverage the vulnerability.\nThese are device models running in either a stub domain or de-privileged\nin Dom0."
        }
      ],
      "datePublic": "2026-07-28T12:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Parts of the DM_OP handling code assumes the caller has provided the\nrequired number of buffers for the given operation without any checking\nbeing done.  As a result, certain operations might access stack\nrubble as structures are possibly uninitialized."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": "A device model of a HVM guest can gain insight on the contents of the\nXen stack, thus possibly leaking data from other guests contexts."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-28T12:32:59.802Z",
        "orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
        "shortName": "XEN"
      },
      "references": [
        {
          "url": "https://xenbits.xenproject.org/xsa/advisory-506.html"
        }
      ],
      "title": "correct buffer checks for DM_OP hypercalls",
      "workarounds": [
        {
          "lang": "en",
          "value": "Running only PV or PVH guests will avoid the vulnerability.\n\n(Switching from a device model stub domain or a de-privileged device\nmodel to a fully privileged Dom0 device model does NOT mitigate this\nvulnerability.  Rather, it simply recategorises the vulnerability to\nhostile management code, regarding it \"as designed\"; thus it merely\nreclassifies these issues as \"not a bug\".  The security of a Xen system\nusing stub domains is still better than with a qemu-dm running as a Dom0\nprocess.  Users and vendors of stub qemu dm systems should not change\ntheir configuration to use a Dom0 QEMU process.)"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
    "assignerShortName": "XEN",
    "cveId": "CVE-2026-62433",
    "datePublished": "2026-07-28T12:32:59.802Z",
    "dateReserved": "2026-07-14T10:28:12.655Z",
    "dateUpdated": "2026-07-28T16:33:33.573Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-62433",
      "date": "2026-09-20",
      "epss": "0.00253",
      "percentile": "0.17058"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unknown",
                "product": "Xen",
                "vendor": "Xen",
                "versions": [
                  {
                    "status": "unknown",
                    "version": "consult Xen advisory XSA-506"
                  }
                ]
              }
            ],
            "source": "security@xen.org"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Parts of the DM_OP handling code assumes the caller has provided the\nrequired number of buffers for the given operation without any checking\nbeing done.  As a result, certain operations might access stack\nrubble as structures are possibly uninitialized."
          }
        ],
        "id": "CVE-2026-62433",
        "lastModified": "2026-07-28T17:16:57.470",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "LOW",
                "baseScore": 7.3,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "LOW",
                "integrityImpact": "LOW",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 3.4,
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-62433",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-28T15:03:57.527525Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-07-28T13:19:02.207",
        "references": [
          {
            "source": "security@xen.org",
            "url": "https://xenbits.xenproject.org/xsa/advisory-506.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://www.openwall.com/lists/oss-security/2026/07/28/22"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "url": "http://xenbits.xen.org/xsa/advisory-506.html"
          }
        ],
        "sourceIdentifier": "security@xen.org",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-665"
              }
            ],
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2026-07-28T18:10:47+00:00",
      "cve": "CVE-2026-62433",
      "id": "CVE-2026-62433",
      "initial_release_date": "2026-07-28T12:32:59.802000+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "xen: Xen: Information disclosure via improper buffer validation in DM_OP hypercalls",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-62433.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-18T00:48:58Z",
      "cve": "CVE-2026-62433",
      "id": "CVE-2026-62433",
      "initial_release_date": "2026-07-30T16:35:45Z",
      "product_status:known_affected": "462",
      "product_status:recommended": "128",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-62433",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-62433.json",
      "version": "7"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "providerMetadata": {
              "dateUpdated": "2026-07-28T16:33:33.573Z",
              "orgId": "af854a3a-2127-422b-91ae-364da2661108",
              "shortName": "CVE"
            },
            "references": [
              {
                "url": "http://xenbits.xen.org/xsa/advisory-506.html"
              },
              {
                "url": "http://www.openwall.com/lists/oss-security/2026/07/28/22"
              }
            ],
            "title": "CVE Program Container"
          },
          {
            "metrics": [
              {
                "cvssV3_1": {
                  "attackComplexity": "LOW",
                  "attackVector": "NETWORK",
                  "availabilityImpact": "LOW",
                  "baseScore": 7.3,
                  "baseSeverity": "HIGH",
                  "confidentialityImpact": "LOW",
                  "integrityImpact": "LOW",
                  "privilegesRequired": "NONE",
                  "scope": "UNCHANGED",
                  "userInteraction": "NONE",
                  "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
                  "version": "3.1"
                }
              },
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-62433",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-07-28T15:03:57.527525Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "problemTypes": [
              {
                "descriptions": [
                  {
                    "cweId": "CWE-665",
                    "description": "CWE-665 Improper Initialization",
                    "lang": "en",
                    "type": "CWE"
                  }
                ]
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-07-28T15:03:18.873Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "defaultStatus": "unknown",
              "product": "Xen",
              "vendor": "Xen",
              "versions": [
                {
                  "status": "unknown",
                  "version": "consult Xen advisory XSA-506"
                }
              ]
            }
          ],
          "configurations": [
            {
              "lang": "en",
              "value": "All Xen versions from 4.10 onwards are vulnerable.  Xen versions 4.9 and\nearlier are not vulnerable.\n\nOnly entities controlling HVM guests can leverage the vulnerability.\nThese are device models running in either a stub domain or de-privileged\nin Dom0."
            }
          ],
          "datePublic": "2026-07-28T12:00:00.000Z",
          "descriptions": [
            {
              "lang": "en",
              "value": "Parts of the DM_OP handling code assumes the caller has provided the\nrequired number of buffers for the given operation without any checking\nbeing done.  As a result, certain operations might access stack\nrubble as structures are possibly uninitialized."
            }
          ],
          "impacts": [
            {
              "descriptions": [
                {
                  "lang": "en",
                  "value": "A device model of a HVM guest can gain insight on the contents of the\nXen stack, thus possibly leaking data from other guests contexts."
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-07-28T12:32:59.802Z",
            "orgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
            "shortName": "XEN"
          },
          "references": [
            {
              "url": "https://xenbits.xenproject.org/xsa/advisory-506.html"
            }
          ],
          "title": "correct buffer checks for DM_OP hypercalls",
          "workarounds": [
            {
              "lang": "en",
              "value": "Running only PV or PVH guests will avoid the vulnerability.\n\n(Switching from a device model stub domain or a de-privileged device\nmodel to a fully privileged Dom0 device model does NOT mitigate this\nvulnerability.  Rather, it simply recategorises the vulnerability to\nhostile management code, regarding it \"as designed\"; thus it merely\nreclassifies these issues as \"not a bug\".  The security of a Xen system\nusing stub domains is still better than with a qemu-dm running as a Dom0\nprocess.  Users and vendors of stub qemu dm systems should not change\ntheir configuration to use a Dom0 QEMU process.)"
            }
          ]
        }
      },
      "cveMetadata": {
        "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f",
        "assignerShortName": "XEN",
        "cveId": "CVE-2026-62433",
        "datePublished": "2026-07-28T12:32:59.802Z",
        "dateReserved": "2026-07-14T10:28:12.655Z",
        "dateUpdated": "2026-07-28T16:33:33.573Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.