Grant‑copy operations within the Xen hypervisor can trigger a type‑confusion bug (CWE‑367) that causes permission checks to be performed on a memory page that is not the one intended for copying. This inconsistency can allow an attacker to bypass proper access controls and read or modify guest memory that should be protected. The flaw thus threatens both confidentiality and integrity of virtual machine data, potentially enabling unauthorized modification or disclosure of sensitive information across virtual machine boundaries.

The vulnerability is present in Xen hypervisor implementations that provide the grant‑copy functionality. No specific product versions are listed, so any Xen deployment that uses grant‑copy should be assessed for the presence of the bug. Operators of Xen hypervisors should review their current hypervisor version and determine whether it includes the cited bug before taking further action.

The CVSS score of 7.8 indicates moderate‑to‑high severity. The EPSS score of less than 1% suggests that, as of now, exploitation is unlikely, but the risk remains real because the flaw permits memory access across guest domains. The vulnerability is not listed in CISA’s KEV catalog, indicating no confirmed exploitation yet. Based on the description, it is inferred that exploitation requires a privileged hypervisor actor who can create grants or perform grant‑copy operations. An attacker with such privileges could construct a grant that references a protected page, trigger a grant‑copy, and read or alter memory that the correct permission checks would not normally allow.