Description
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windows PV drivers expose various facilities to userspace. Several of these have no security descriptor, and are therefore fully accessible to unprivileged users. These are: 1. XenCons, CVE-2025-27462 2. XenIface, CVE-2025-27463 3. XenBus, CVE-2025-27464
Published: 2026-07-09
Score: 9.4 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Xen Windows PV driver set contains a XenIface device that is exposed to userspace without a defined security descriptor. Because the device lacks permission checks, any local user running inside the Windows virtual machine can read from and write to the XenIface endpoint. This flaw is identified as CWE‑276 (Incorrect Permissions) and effectively allows an attacker to gain elevated privileges within the guest operating system.

Affected Systems

The vulnerability impacts Xen Windows PV drivers, specifically the XenIface device used in Windows virtual machines. No particular version numbers are identified in the CNA information, so all current releases of the Xen Windows PV driver are potentially affected.

Risk and Exploitability

The CVSS score of 9.4 classifies this issue as critical, while the EPSS score of less than 1% indicates a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Based on the description, the attack vector is local to the virtual machine; any user with local access to the guest can exploit the missing security descriptor to elevate privileges.

Generated by OpenCVE AI on July 29, 2026 at 12:24 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Xen Windows PV driver to a version that implements proper security descriptors for the XenIface device.
  • If a patch is unavailable, use Windows device management or local security policies to disable or restrict access to the XenIface device within the guest.
  • Enable auditing or logging for attempts to open or interact with the XenIface device so that malicious activity can be detected.

Generated by OpenCVE AI on July 29, 2026 at 12:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 10 Jul 2026 10:15:00 +0000

Type Values Removed Values Added
First Time appeared Xen
Xen windows Pv Drivers
Vendors & Products Xen
Xen windows Pv Drivers

Thu, 09 Jul 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 09 Jul 2026 15:45:00 +0000

Type Values Removed Values Added
Description [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windows PV drivers expose various facilities to userspace. Several of these have no security descriptor, and are therefore fully accessible to unprivileged users. These are: 1. XenCons, CVE-2025-27462 2. XenIface, CVE-2025-27463 3. XenBus, CVE-2025-27464
Title WinPVDrivers: Excessive permissions on user-exposed devices
Weaknesses CWE-276
References
Metrics cvssV4_0

{'score': 9.4, 'vector': 'CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}

Subscriptions

Xen Windows Pv Drivers
cve-icon MITRE

Status: PUBLISHED

Assigner: XEN

Published:

Updated: 2026-07-09T15:52:14.394Z

Reserved: 2025-02-26T09:16:54.461Z

Link: CVE-2025-27463

cve-icon Vulnrichment

Updated: 2026-07-09T15:52:11.225Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-29T12:30:03Z

Weaknesses
  • CWE-276

    Incorrect Default Permissions