Executive brief
A vulnerability in the Xen virtualization platform's disk image handling library could allow a malicious guest operating system to take control of the physical host server. By providing a specially crafted ISO disk image, an attacker can bypass security boundaries between the virtual machine and the host. This could lead to a total compromise of the host system, including access to data from other customers or tenants.
Technical details
The iso9660 driver within Xen's libfsimage library fails to validate lengths derived from attacker-controlled on-disk fields during directory and Rock Ridge/SUSP walks. Specifically, CVE-2026-62425 involves the Rock Ridge Continuation Entry (CE) record processing assuming valid size and offset values without verification. An attacker with the ability to provide a malicious ISO image to the pygrub bootloader can trigger a buffer overrun. This allows a guest to escalate privileges to the context of the domain construction tools, which typically results in full host compromise. A patch is available, and mitigations include running pygrub in a de-privileged mode or using alternative bootloaders like pvgrub.
Affected products
- Xen Project Xen 3.2 and later
Timeline
- 2026-07-28: advisory: XSA-497 published by Xen Project
- 2026-07-28: disclosed
- 2026-07-28: patched