# CVE-2026-62424: Xen libfsimage buffer overrun in Rock Ridge NM record processing

Source: https://junglewise.ai/threats/cve-2026-62424-xen-libfsimage-buffer-overrun-in-rock-ridge-nm-record-processing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-28. Updated: 2026-07-28  
License: CC BY 4.0 with a link back

CVE-2026-62424 · Severity: info · CVSS 0 · Published 2026-07-28

A vulnerability exists in the Xen virtualization platform's file system image library (libfsimage). A malicious guest operating system can provide a specially crafted disk image that, when processed by the pygrub bootloader, allows the guest to escape its isolation and potentially take full control of the host server. This could lead to unauthorized access to other guests' data or a complete compromise of the virtualization infrastructure.

Technologies: [Xen Project Xen](https://junglewise.ai/threats/technologies/xen). Vendors: [Xen Project](https://junglewise.ai/threats/vendors/xen-project).

## Quick answers

**Is CVE-2026-62424 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62424 being exploited in the wild.

**How severe is CVE-2026-62424?** Informational severity, with a CVSS score of 0, published 28 July 2026.

**Which products and versions are affected?** Xen Project Xen 3.2 and later.

**Is there a fix for CVE-2026-62424?** A patch was published on 2026-07-28. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-62424 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-62424?** Check whether you run Xen Project Xen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A buffer overrun vulnerability exists in the iso9660 driver of libfsimage, specifically within the Rock Ridge NM (Name) record processing. The vulnerability stems from the driver deriving entry lengths directly from attacker-controlled on-disk fields without proper validation. An attacker with control over a guest's disk image can exploit this during the pygrub boot process to trigger a buffer overflow. This can lead to arbitrary code execution in the context of the domain construction tools, typically resulting in a full host escape. Mitigation is available by running pygrub in a de-privileged mode or using alternative bootloaders like pvgrub.

## Affected products

- Xen Project Xen 3.2 and later

## Timeline

- 2026-07-28: disclosed
- 2026-07-28: advisory
- 2026-07-28: patched

## References

- [https://xenbits.xenproject.org/xsa/advisory-497.html](https://xenbits.xenproject.org/xsa/advisory-497.html)

## Related threats

- [Xen arbitrary read/write via grant copy caching](https://junglewise.ai/threats/cve-2026-102704-this-cna-information-record-relates-to-multiple-cves-the-text)
- [Xen hypervisor arbitrary read/write via grant copy](https://junglewise.ai/threats/cve-2026-102703-this-cna-information-record-relates-to-multiple-cves-the-text)
- [Xen VMX VMentry failure with branch tracing and blocked states](https://junglewise.ai/threats/cve-2026-79611-for-xsa-308-logic-was-introduced-as-vmx-vmentry-checks-do-not)
- [Xen XPTI privilege escalation on huge-memory systems](https://junglewise.ai/threats/cve-2026-79609-xpti-xen-page-table-isolation-was-introduced-to-mitigate-meltdown)
- [Xen ineffectual Zenbleed workaround on AMD x86](https://junglewise.ai/threats/cve-2026-79608-the-workaround-for-xsa-433-zenbleed-was-later-re-worked-to-better)