# CVE-2025-27462: Xen Project Windows PV drivers incorrect default permissions in XenCons

Source: https://junglewise.ai/threats/cve-2025-27462-xen-project-windows-pv-drivers-incorrect-default-permissions-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-09. Updated: 2026-07-09  
License: CC BY 4.0 with a link back

CVE-2025-27462 · Severity: info · CVSS 9.4 · Published 2026-07-09

The Xen Project Windows Paravirtual (PV) drivers, which improve performance for Windows virtual machines running on Xen, contain a security flaw in how they manage access permissions. Because certain driver components lack proper security restrictions, any standard user on the virtual machine can interact with them directly. This allows a low-privileged user to gain full control over the guest operating system, potentially leading to data theft or complete system compromise.

Technologies: [Xen Project Windows PV drivers](https://junglewise.ai/threats/technologies/windows-pv-drivers). Vendors: [Xen Project](https://junglewise.ai/threats/vendors/xen-project).

## Quick answers

**Is CVE-2025-27462 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-27462 being exploited in the wild.

**How severe is CVE-2025-27462?** Informational severity, with a CVSS score of 9.4, published 9 July 2026.

**Which products and versions are affected?** Xen Project Windows PV drivers All versions (XenCons since 9.0.0).

**Is there a fix for CVE-2025-27462?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-27462 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2025-27462?** Check whether you run Xen Project Windows PV drivers at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Windows PV drivers (specifically XenCons, XenIface, and XenBus) expose device objects to userspace without associated security descriptors. This lack of access control (CWE-276) means these facilities are fully accessible to unprivileged users. An attacker with local access to a Windows guest VM can exploit these unprotected interfaces to escalate their privileges to the level of the guest kernel. The vulnerability in XenCons (CVE-2025-27462) was introduced in version 9.0.0, while XenIface and XenBus have been vulnerable since their inception. Patches and a mitigation PowerShell script are available from the Xen Project.

## Affected products

- Xen Project Windows PV drivers All versions (XenCons since 9.0.0)

## Timeline

- 2025-05-27: advisory: Initial public release of XSA-468
- 2026-07-09: disclosed: CVE-2025-27462 published to NVD

## References

- [https://xenbits.xen.org/xsa/advisory-468.html](https://xenbits.xen.org/xsa/advisory-468.html)

## Related threats

- [Xen Project Windows PV drivers privilege escalation in XenBus](https://junglewise.ai/threats/cve-2025-27464-xen-project-windows-pv-drivers-privilege-escalation-in-xenbus)
- [Xen Project Windows PV drivers privilege escalation in XenIface](https://junglewise.ai/threats/cve-2025-27463-xen-project-windows-pv-drivers-privilege-escalation-in-xeniface)