# CVE-2025-27464: Xen Project Windows PV drivers privilege escalation in XenBus

Source: https://junglewise.ai/threats/cve-2025-27464-xen-project-windows-pv-drivers-privilege-escalation-in-xenbus  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-09. Updated: 2026-07-09  
License: CC BY 4.0 with a link back

CVE-2025-27464 · Severity: info · CVSS 9.4 · Published 2026-07-09

The Xen Project Windows Paravirtual (PV) drivers, which improve the performance of Windows virtual machines running on Xen, contain a security flaw in the XenBus component. This flaw allows standard, unprivileged users on a Windows virtual machine to gain full administrative or kernel-level control of that system. This could lead to a complete compromise of the virtual machine's data and operations.

Technologies: [Xen Project Windows PV drivers](https://junglewise.ai/threats/technologies/windows-pv-drivers). Vendors: [Xen Project](https://junglewise.ai/threats/vendors/xen-project).

## Quick answers

**Is CVE-2025-27464 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-27464 being exploited in the wild.

**How severe is CVE-2025-27464?** Informational severity, with a CVSS score of 9.4, published 9 July 2026.

**Which products and versions are affected?** Xen Project Windows PV drivers All versions.

**Is there a fix for CVE-2025-27464?** A patch was published on 2025-05-27: Patches released for XenBus, XenCons, and XenIface Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-27464 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2025-27464?** Check whether you run Xen Project Windows PV drivers at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The XenBus driver in the Xen Project Windows PV driver suite fails to apply security descriptors to various facilities exposed to userspace. This lack of access control (CWE-276) means these interfaces are fully accessible to unprivileged local users. An attacker with local access to a Windows guest VM can exploit these unprotected interfaces to achieve a privilege escalation from a standard user to the guest kernel. The vulnerability affects all versions of the XenBus driver. Patches have been released by the Xen Project to apply the necessary security descriptors.

## Affected products

- Xen Project Windows PV drivers All versions

## Timeline

- 2025-05-27: disclosed: Initial public release of XSA-468
- 2025-05-27: patched: Patches released for XenBus, XenCons, and XenIface
- 2026-07-09: advisory: NVD publication date

## References

- [https://xenbits.xen.org/xsa/advisory-468.html](https://xenbits.xen.org/xsa/advisory-468.html)

## Related threats

- [Xen Project Windows PV drivers privilege escalation in XenIface](https://junglewise.ai/threats/cve-2025-27463-xen-project-windows-pv-drivers-privilege-escalation-in-xeniface)
- [Xen Project Windows PV drivers incorrect default permissions in XenCons](https://junglewise.ai/threats/cve-2025-27462-xen-project-windows-pv-drivers-incorrect-default-permissions-in)