The flaw resides in Xen’s libfsimage ISO9660 handler, where several length fields are taken directly from on‑disk data in a Rock Ridge NM record. The unchecked values can lead to a signed integer underflow and buffer overrun, corrupting memory held by the hypervisor process. Although the description does not indicate that arbitrary code execution is possible, the resulting memory corruption can cause the hypervisor to crash, reboot unexpectedly, or exhibit undefined behavior, effectively providing a denial‑of‑service or, when the vulnerability is triggered at boot, a possible elevation of privileges within the hypervisor domain.

The affected vendor is Xen, and the product impacted is the Xen hypervisor’s libfsimage library that parses ISO9660 file systems. No specific kernel or release versions are listed in the CNA data, implying that any Xen build that incorporates the affected driver may be vulnerable.

The CVSS score of 5.5 indicates medium severity, and the EPSS score of < 1% reflects a very low likelihood of exploitation at the time of the advisory. The vulnerability is not listed in CISA KEV, implying no known active attacks. The most likely attack vector is a local or boot‑time attack via a crafted ISO image that contains a malicious Rock Ridge NM record; the vulnerability is exercised when a guest or the host uses the pygrub bootloader or when the host’s libfsimage processes an ISO file during boot or guest import.