Quick answers
- Is CVE-2026-42494 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-42494 being exploited in the wild.
- How severe is CVE-2026-42494?
- Informational severity, with a CVSS score of 0, published 28 July 2026.
- Which products and versions are affected?
- Xen Project Xen 3.2 and later.
- Is there a fix for CVE-2026-42494?
- A patch was published on 2026-07-28. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-42494 attacked?
- It is attacked with local access, in an operating system.
- Am I affected by CVE-2026-42494?
- Check whether you run Xen Project Xen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
Multiple buffer overflow vulnerabilities exist in the libfsimage iso9660 driver used by pygrub. The vulnerabilities (CVE-2026-42494, CVE-2026-42495, CVE-2026-62423, CVE-2026-62424, and CVE-2026-62425) stem from the driver deriving record lengths, offsets, and entry sizes directly from attacker-controlled on-disk fields without proper validation during directory and Rock Ridge/SUSP walks. An attacker with the ability to provide a malicious ISO image to pygrub (typically a guest VM administrator) can trigger these overflows to execute arbitrary code with the privileges of the domain construction tools, potentially leading to a full host escape. Patches are available via Xen Security Advisory XSA-497.
Affected products
- Xen Project Xen 3.2 and later
Timeline
- 2026-07-28: disclosed
- 2026-07-28: advisory
- 2026-07-28: patched