The Xen Windows PV drivers expose three device interfaces—XenCons, XenIface, and XenBus—to user space without any security descriptors. Because these interfaces lack access controls, any local user who can open or communicate with the device file gains full read and write privileges to the PV driver. This flaw is an example of CWE‑276 (Insufficient Permissions), allowing an attacker to perform actions normally reserved for privileged contexts, such as manipulating virtualization settings or accessing sensitive data within the guest environment.

The vulnerability affects every installation of the Xen Windows PV driver suite that includes the XenCons, XenIface, or XenBus device interfaces. No specific version numbers are supplied, so all deployments that expose these interfaces are considered vulnerable.

With a CVSS score of 9.4 the flaw is classified as critical, and an EPSS value of less than 1 % indicates a historically low probability of exploitation. The flaw is, however, trivially exploitable by any local user because the Windows driver interface requires no authentication or privilege checks. The vulnerability is not listed in the CISA KEV catalog, but its high severity and the fact that it permits uncontrolled access to kernel‑level PV drivers warrant immediate attention. The likely attack vector is a local user opening the exposed device and sending privileged commands to the driver.