The flaw allows an unprivileged guest to issue a Xenstore command that accesses the node path "/local/domain/", an illegal path. This triggers a crash in xenstored as it clobbers an error indicator while verifying the node path, causing a failing assert(). In builds where NDEBUG is defined, the crash does not terminate xenstored but forces it to consume all available CPU time, effectively denying service to the Xenstore daemon. The weakness is a classic assertion fault, identified as CWE‑617.

This vulnerability affects Xen virtualization products from the Xen vendor. No specific version information is published, so all current Xen releases may be impacted until a patch is released.

The CVSS score of 7.1 indicates a medium to high severity. The EPSS score is below 1%, suggesting low exploitation likelihood, and the vulnerability is not listed in CISA's KEV catalog. The attack requires an unprivileged guest within the same Xen environment to trigger the node path access, meaning the vector is local to the guest rather than external. If an attacker gains the ability to submit Xenstore requests, they can force xenstored into a DoS state, degrading the entire virtualized host.