The Windows PV drivers bundled with Xen expose device interfaces such as XenCons, XenIface, and XenBus to userspace but fail to set a security descriptor on these interfaces. This insecure permission configuration, classified as CWE-276, allows any local user to open and interact with the drivers as if they had elevated privileges. The consequence is that a malicious actor can invoke privileged driver functionality and potentially gain additional privileges on the host system.

The flaw affects the Windows PV drivers integrated into the Xen hypervisor. Specifically, the XenCons, XenIface, and XenBus drivers are susceptible. Vendors that ship the standard Xen hypervisor with Windows PV support and that have not applied a corrective update are at risk; version information is not supplied in the CNA record, so any unpatched deployment should be considered vulnerable.

With a CVSS score of 9.4, the vulnerability is deemed critical. The EPSS score of less than 1% indicates a low likelihood of widespread exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the lack of access control creates a local privilege escalation path independent of external attack surfaces, making the risk significant for environments where untrusted users may execute code on the affected host. Based on the description, it is inferred that the attack vector is local; a user who can run code in the guest must be able to access the misdescribed driver interfaces.