# CVE-2025-58148: [This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to…

Source: https://junglewise.ai/threats/cve-2025-58148-this-cna-information-record-relates-to-multiple-cves-the-text  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-10-31  
License: CC BY 4.0 with a link back

CVE-2025-58148 · Severity: high · CVSS 7.5 · Published 2025-10-31

[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]

Some Viridian hypercalls can specify a mask of vCPU IDs as an input, in
one of three formats.  Xen has boundary checking bugs with all three
formats, which can cause out-of-bounds reads and writes while processing
the inputs.

 * CVE-2025-58147.  Hypercalls using the HV_VP_SET Sparse format can
   cause vpmask_set() to write out of bounds when converting the bitmap
   to Xen's format.

 * CVE-2025-58148.  Hypercalls using any input format can cause
   send_ipi() to read d->vcpu[] out-of-bounds, and operate on a wild
   vCPU pointer.

Technologies: [Xen](https://junglewise.ai/threats/technologies/xen-xen). Vendors: [Xen](https://junglewise.ai/threats/vendors/xen).

## Quick answers

**Is CVE-2025-58148 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-58148 being exploited in the wild.

**How severe is CVE-2025-58148?** High severity, with a CVSS score of 7.5, published 31 October 2025.

**Which products and versions are affected?** Xen. The advisory does not name versions.

**Is there a fix for CVE-2025-58148?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-58148?** Check whether you run Xen. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- Xen

## Related threats

- [Xen grant-table double version change race condition](https://junglewise.ai/threats/cve-2026-79610-xsa-501-was-about-issues-with-v1-v2-and-v2-v1-changes-racing)
- [Xen Xenstore crash during live update with watch depth](https://junglewise.ai/threats/cve-2026-79607-during-xenstore-live-update-the-state-record-for-a-xenstore-watch)
- [When passing through PCI devices, the detach logic in libxl won't remove access permissions to any 64bit memory BARs the device might have.](https://junglewise.ai/threats/cve-2025-58149-when-passing-through-pci-devices-the-detach-logic-in-libxl-won-t)
- [[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to…](https://junglewise.ai/threats/cve-2025-58147-this-cna-information-record-relates-to-multiple-cves-the-text)