Is CVE-2026-42488 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-42488 being exploited in the wild.

How severe is CVE-2026-42488?

High severity, with a CVSS score of 8.1, published 18 June 2026.

Which products and versions are affected?

Xen Project Xen 4.15 and onwards; versions with XSA-438 fix applied.

Is there a fix for CVE-2026-42488?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-42488 attacked?

It is attacked over the network, in an operating system.

Am I affected by CVE-2026-42488?

Check whether you run Xen Project Xen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-42488: Xen x86 mapcache corruption in shadow paging error paths

CVE-2026-42488 · Severity: high · CVSS 8.1 · Published 2026-06-18

A vulnerability exists in the Xen hypervisor, which is software used to run multiple virtual machines on a single physical server. An attacker controlling a specific type of virtual machine can cause the server's memory management system to become corrupted. This could allow the attacker to crash the entire physical host, steal sensitive information from other users, or gain unauthorized control over the server.

Technologies: Xen Project Xen. Vendors: Xen Project.

Quick answers

Is CVE-2026-42488 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-42488 being exploited in the wild.
How severe is CVE-2026-42488?: High severity, with a CVSS score of 8.1, published 18 June 2026.
Which products and versions are affected?: Xen Project Xen 4.15 and onwards; versions with XSA-438 fix applied.
Is there a fix for CVE-2026-42488?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-42488 attacked?: It is attacked over the network, in an operating system.
Am I affected by CVE-2026-42488?: Check whether you run Xen Project Xen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability in Xen's x86 shadow paging implementation occurs when certain error paths switch page-tables without updating the currently running vCPU reference. This creates a mismatch between loaded page-tables and mapcache metadata, leading to mapcache corruption. The issue specifically affects 64-bit PV guests running in shadow mode (often used during migration or as an L1TF workaround). An attacker with control over such a guest can exploit this to achieve privilege escalation, host-wide Denial of Service (DoS), or information disclosure. Patches are available for Xen versions 4.17 through 4.21 and the unstable branch.

Affected products

Xen Project Xen 4.15 and onwards; versions with XSA-438 fix applied

Timeline

2026-06-09: advisory: XSA-494 initial public release
2026-06-18: disclosed: CVE-2026-42488 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.