Is CVE-2025-27462 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-27462 being exploited in the wild.

How severe is CVE-2025-27462?

Informational severity, with a CVSS score of 9.4, published 9 July 2026.

Which products and versions are affected?

Xen Project Windows PV drivers All versions (XenCons since 9.0.0).

Is there a fix for CVE-2025-27462?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-27462 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2025-27462?

Check whether you run Xen Project Windows PV drivers at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-27462: Xen Project Windows PV drivers incorrect default permissions in XenCons

CVE-2025-27462 · Severity: info · CVSS 9.4 · Published 2026-07-09

The Xen Project Windows Paravirtual (PV) drivers, which improve performance for Windows virtual machines running on Xen, contain a security flaw in how they manage access permissions. Because certain driver components lack proper security restrictions, any standard user on the virtual machine can interact with them directly. This allows a low-privileged user to gain full control over the guest operating system, potentially leading to data theft or complete system compromise.

Technologies: Xen Project Windows PV drivers. Vendors: Xen Project.

Quick answers

Is CVE-2025-27462 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-27462 being exploited in the wild.
How severe is CVE-2025-27462?: Informational severity, with a CVSS score of 9.4, published 9 July 2026.
Which products and versions are affected?: Xen Project Windows PV drivers All versions (XenCons since 9.0.0).
Is there a fix for CVE-2025-27462?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-27462 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2025-27462?: Check whether you run Xen Project Windows PV drivers at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Windows PV drivers (specifically XenCons, XenIface, and XenBus) expose device objects to userspace without associated security descriptors. This lack of access control (CWE-276) means these facilities are fully accessible to unprivileged users. An attacker with local access to a Windows guest VM can exploit these unprotected interfaces to escalate their privileges to the level of the guest kernel. The vulnerability in XenCons (CVE-2025-27462) was introduced in version 9.0.0, while XenIface and XenBus have been vulnerable since their inception. Patches and a mitigation PowerShell script are available from the Xen Project.

Affected products

Xen Project Windows PV drivers All versions (XenCons since 9.0.0)

Timeline

2025-05-27: advisory: Initial public release of XSA-468
2026-07-09: disclosed: CVE-2025-27462 published to NVD

References

https://xenbits.xen.org/xsa/advisory-468.html

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.