The vulnerability is a buffer overrun in Xen's libfsimage ISO9660 driver that derives several length values directly from on‑disk fields without validation. An attacker can supply a crafted ISO9660 image with an oversized or negative length field. When Xen parses that image, the driver may write beyond the bounds of the allocated buffer, corrupting memory and potentially enabling arbitrary code execution or a denial‑of‑service within the hypervisor or the guest.

The flaw exists in the Xen hypervisor component libfsimage, which processes ISO9660 images. All Xen deployments that use the default ISO9660 driver to boot guests from ISO images are potentially affected. No specific version range is given, so every current Xen release that includes libfsimage’s ISO9660 code requires mitigation.

The CVSS score of 6.1 indicates moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation at this time. The vulnerability is not listed in CISA KEV. The likely attack vector, inferred from the CNA workaround and usage of pygrub, is that an attacker supplies a malicious ISO9660 image to a Xen guest that boots using pygrub or a related path. The XSA‑443 workaround mitigates the issue by running pygrub in a de‑privileged mode or by avoiding pygrub altogether, for example by switching to pvgrub or the standard grub2 bootloader. Because the flaw is triggered only during ISO9660 parsing, it is unlikely to be exploited in environments that do not use user‑supplied ISO images.