Parts of the Xen hypervisor’s DM_OP handling code assume the calling guest provides the requisite number of buffers without performing any validation. As a result, certain operations can read or write memory on the host stack that has not been initialized. The likely consequence is that a malicious or compromised guest can gain arbitrary host memory access, potentially enabling privilege escalation from the guest context to the hypervisor level. The design flaw reflects a missing buffer count check (CWE‑665).

Xen hypervisors that implement the legacy DM_OP handling routine are affected. The available data does not specify which version numbers are patched, so any Xen installation that relies on the unpatched DM_OP code may be vulnerable. Administrators should verify whether their hypervisor build includes the corrected buffer‑check logic introduced in recent Xen releases.

The CVSS score of 7.3 indicates moderate to high severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is local from a compromised guest that can issue DM_OP hypercalls; achieving the exploit would require that the guest be able to trigger the offending operations. No public exploit is documented, but the flaw remains a viable target for adversaries that maintain guest access.