XAPI accepts user supplied strings without sufficient sanitization, enabling malicious data to be used in notification generation. When XAPI processes these strings, the database event thread crashes, stopping all further event handling and rendering the XAPI interface unusable. In addition, XAPI’s UTF‑8 encoder follows Unicode 3.0 while the other libraries it depends on adhere to Unicode 3.1; as a result, strings deemed valid by XAPI may be rejected by those libraries, leading to database corruption and an inability to load the database. Finally, XAPI’s Map/Set update operations lack any input validation, providing another vector for corrupt data to be written into the database. Together, these flaws cause a complete denial of the XAPI service and, when the database cannot be loaded, can disrupt the hypervisor’s management functions.

The vulnerability affects Xen’s XAPI component, which is the management interface of the Xen hypervisor platform. No specific version numbers appear in the advisory, so any installation that exposes the documented input handling mechanisms is potentially vulnerable.

The base CVSS score of 9.4 marks this bug as critical, yet the EPSS score is less than 1 %, indicating a very low probability of real‑world exploitation as of this analysis. The vulnerability is not listed in the CISA KEV catalog. Attackers would need remote access to the XAPI interface, likely via its REST API or similar management ports, and sufficient privileges to submit malicious input. Once access is achieved, a crafted payload can trigger the event thread crash or inject malformed UTF‑8 strings that corrupt the database.