# CVE-2026-42494: Xen libfsimage buffer overruns in iso9660 handling

Source: https://junglewise.ai/threats/cve-2026-42494-xen-libfsimage-buffer-overruns-in-iso9660-handling  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-28. Updated: 2026-07-28  
License: CC BY 4.0 with a link back

CVE-2026-42494 · Severity: info · CVSS 0 · Published 2026-07-28

A vulnerability in the Xen virtualization platform's bootloader utility, pygrub, could allow a malicious guest operating system to take control of the entire host server. The issue exists in how the system processes ISO disk images, where specially crafted files can trigger memory errors. This could lead to a total compromise of the host's security and any other virtual machines running on it.

Technologies: [Xen Project Xen](https://junglewise.ai/threats/technologies/xen). Vendors: [Xen Project](https://junglewise.ai/threats/vendors/xen-project).

## Quick answers

**Is CVE-2026-42494 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42494 being exploited in the wild.

**How severe is CVE-2026-42494?** Informational severity, with a CVSS score of 0, published 28 July 2026.

**Which products and versions are affected?** Xen Project Xen 3.2 and later.

**Is there a fix for CVE-2026-42494?** A patch was published on 2026-07-28. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42494 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-42494?** Check whether you run Xen Project Xen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Multiple buffer overflow vulnerabilities exist in the libfsimage iso9660 driver used by pygrub. The vulnerabilities (CVE-2026-42494, CVE-2026-42495, CVE-2026-62423, CVE-2026-62424, and CVE-2026-62425) stem from the driver deriving record lengths, offsets, and entry sizes directly from attacker-controlled on-disk fields without proper validation during directory and Rock Ridge/SUSP walks. An attacker with the ability to provide a malicious ISO image to pygrub (typically a guest VM administrator) can trigger these overflows to execute arbitrary code with the privileges of the domain construction tools, potentially leading to a full host escape. Patches are available via Xen Security Advisory XSA-497.

## Affected products

- Xen Project Xen 3.2 and later

## Timeline

- 2026-07-28: disclosed
- 2026-07-28: advisory
- 2026-07-28: patched

## References

- [https://xenbits.xenproject.org/xsa/advisory-497.html](https://xenbits.xenproject.org/xsa/advisory-497.html)

## Related threats

- [Xen arbitrary read/write via grant copy caching](https://junglewise.ai/threats/cve-2026-102704-this-cna-information-record-relates-to-multiple-cves-the-text)
- [Xen hypervisor arbitrary read/write via grant copy](https://junglewise.ai/threats/cve-2026-102703-this-cna-information-record-relates-to-multiple-cves-the-text)
- [Xen VMX VMentry failure with branch tracing and blocked states](https://junglewise.ai/threats/cve-2026-79611-for-xsa-308-logic-was-introduced-as-vmx-vmentry-checks-do-not)
- [Xen XPTI privilege escalation on huge-memory systems](https://junglewise.ai/threats/cve-2026-79609-xpti-xen-page-table-isolation-was-introduced-to-mitigate-meltdown)
- [Xen ineffectual Zenbleed workaround on AMD x86](https://junglewise.ai/threats/cve-2026-79608-the-workaround-for-xsa-433-zenbleed-was-later-re-worked-to-better)