# CVE-2026-42495: Xen libfsimage integer underflow in iso9660 System Use area calculation

Source: https://junglewise.ai/threats/cve-2026-42495-xen-libfsimage-integer-underflow-in-iso9660-system-use-area  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-28. Updated: 2026-07-28  
License: CC BY 4.0 with a link back

CVE-2026-42495 · Severity: info · CVSS 8.8 · Published 2026-07-28

A vulnerability exists in the Xen virtualization platform's tool for reading disk images. A malicious guest operating system can provide a specially crafted disk image that triggers a memory error when the host attempts to boot the guest. If successful, this allows the guest to break out of its isolation and gain full control over the host server, potentially compromising all other data and services on that physical machine.

Technologies: [Xen Project Xen](https://junglewise.ai/threats/technologies/xen). Vendors: [Xen Project](https://junglewise.ai/threats/vendors/xen-project).

## Quick answers

**Is CVE-2026-42495 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-42495 being exploited in the wild.

**How severe is CVE-2026-42495?** Informational severity, with a CVSS score of 8.8, published 28 July 2026.

**Which products and versions are affected?** Xen Project Xen 3.2 and later.

**Is there a fix for CVE-2026-42495?** A patch was published on 2026-07-28. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-42495 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2026-42495?** Check whether you run Xen Project Xen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the libfsimage iso9660 driver's handling of directory and Rock Ridge / SUSP walks. Specifically, CVE-2026-42495 involves an integer underflow during the calculation of the System Use area size because the driver derives lengths directly from attacker-controlled on-disk fields without validation. An attacker with the ability to provide a malicious ISO image to the pygrub bootloader can trigger a buffer overrun. This allows a guest VM to escalate privileges to the domain construction tools (typically Dom0), leading to a full host compromise. A patch is available from the Xen Project (XSA-497).

## Affected products

- Xen Project Xen 3.2 and later

## Timeline

- 2026-07-28: disclosed
- 2026-07-28: advisory
- 2026-07-28: patched

## References

- [https://xenbits.xenproject.org/xsa/advisory-497.html](https://xenbits.xenproject.org/xsa/advisory-497.html)

## Related threats

- [Xen arbitrary read/write via grant copy caching](https://junglewise.ai/threats/cve-2026-102704-this-cna-information-record-relates-to-multiple-cves-the-text)
- [Xen hypervisor arbitrary read/write via grant copy](https://junglewise.ai/threats/cve-2026-102703-this-cna-information-record-relates-to-multiple-cves-the-text)
- [Xen VMX VMentry failure with branch tracing and blocked states](https://junglewise.ai/threats/cve-2026-79611-for-xsa-308-logic-was-introduced-as-vmx-vmentry-checks-do-not)
- [Xen XPTI privilege escalation on huge-memory systems](https://junglewise.ai/threats/cve-2026-79609-xpti-xen-page-table-isolation-was-introduced-to-mitigate-meltdown)
- [Xen ineffectual Zenbleed workaround on AMD x86](https://junglewise.ai/threats/cve-2026-79608-the-workaround-for-xsa-433-zenbleed-was-later-re-worked-to-better)