Quick answers
- Is CVE-2026-62425 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-62425 being exploited in the wild.
- How severe is CVE-2026-62425?
- Informational severity, with a CVSS score of 8.8, published 28 July 2026.
- Which products and versions are affected?
- Xen Project Xen 3.2 and later.
- Is there a fix for CVE-2026-62425?
- A patch was published on 2026-07-28. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-62425 attacked?
- It is attacked with local access, in an operating system.
- Am I affected by CVE-2026-62425?
- Check whether you run Xen Project Xen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The iso9660 driver within Xen's libfsimage library fails to validate lengths derived from attacker-controlled on-disk fields during directory and Rock Ridge/SUSP walks. Specifically, CVE-2026-62425 involves the Rock Ridge Continuation Entry (CE) record processing assuming valid size and offset values without verification. An attacker with the ability to provide a malicious ISO image to the pygrub bootloader can trigger a buffer overrun. This allows a guest to escalate privileges to the context of the domain construction tools, which typically results in full host compromise. A patch is available, and mitigations include running pygrub in a de-privileged mode or using alternative bootloaders like pvgrub.
Affected products
- Xen Project Xen 3.2 and later
Timeline
- 2026-07-28: advisory: XSA-497 published by Xen Project
- 2026-07-28: disclosed
- 2026-07-28: patched