# CVE-2025-27463: Xen Project Windows PV drivers privilege escalation in XenIface

Source: https://junglewise.ai/threats/cve-2025-27463-xen-project-windows-pv-drivers-privilege-escalation-in-xeniface  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-09. Updated: 2026-07-09  
License: CC BY 4.0 with a link back

CVE-2025-27463 · Severity: info · CVSS 9.4 · Published 2026-07-09

The Xen Project Windows Paravirtual (PV) drivers, which improve the performance of Windows virtual machines running on the Xen hypervisor, contain a security flaw in the XenIface component. This component lacks proper access controls, allowing any standard user on the virtual machine to gain full administrative or kernel-level control. An attacker could use this to bypass security boundaries, access sensitive data, or disrupt the entire guest operating system.

Technologies: [Xen Project Windows PV drivers](https://junglewise.ai/threats/technologies/windows-pv-drivers). Vendors: [Xen Project](https://junglewise.ai/threats/vendors/xen-project).

## Quick answers

**Is CVE-2025-27463 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-27463 being exploited in the wild.

**How severe is CVE-2025-27463?** Informational severity, with a CVSS score of 9.4, published 9 July 2026.

**Which products and versions are affected?** Xen Project Windows PV drivers All versions.

**Is there a fix for CVE-2025-27463?** A patch was published on 2025-05-27: Patches released for xenbus, xencons, and xeniface Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-27463 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2025-27463?** Check whether you run Xen Project Windows PV drivers at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The XenIface component within the Xen Project Windows PV drivers fails to implement security descriptors for certain facilities exposed to userspace. This results in incorrect default permissions (CWE-276), making these interfaces fully accessible to unprivileged users. An attacker with local access to a Windows guest VM can exploit this lack of access control to perform unauthorized operations, leading to a local privilege escalation (LPE) from a standard user to the guest kernel. The vulnerability affects all releases of the xeniface driver. Patches are available from the Xen Project, and a PowerShell mitigation script has been provided to apply security descriptors to existing registry and device objects.

## Affected products

- Xen Project Windows PV drivers All versions

## Timeline

- 2025-05-27: disclosed: Initial public release of XSA-468
- 2025-05-27: patched: Patches released for xenbus, xencons, and xeniface
- 2026-07-09: advisory: NVD publication date

## References

- [https://xenbits.xen.org/xsa/advisory-468.html](https://xenbits.xen.org/xsa/advisory-468.html)

## Related threats

- [Xen Project Windows PV drivers privilege escalation in XenBus](https://junglewise.ai/threats/cve-2025-27464-xen-project-windows-pv-drivers-privilege-escalation-in-xenbus)
- [Xen Project Windows PV drivers incorrect default permissions in XenCons](https://junglewise.ai/threats/cve-2025-27462-xen-project-windows-pv-drivers-incorrect-default-permissions-in)