# CVE-2026-62430: Xen x86 out-of-bounds read in vRTC emulation

Source: https://junglewise.ai/threats/cve-2026-62430-xen-x86-out-of-bounds-read-in-vrtc-emulation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-28. Updated: 2026-07-28  
License: CC BY 4.0 with a link back

CVE-2026-62430 · Severity: info · CVSS 0 · Published 2026-07-28

A vulnerability exists in the Xen virtualization platform, which is used to run multiple virtual machines on a single physical server. A malicious user operating a guest virtual machine could exploit a flaw in how the system handles hardware clock emulation to read memory that should be restricted. While this allows access to internal system data, it does not directly allow the attacker to view data belonging to other customers' virtual machines.

Technologies: [Xen Project Xen](https://junglewise.ai/threats/technologies/xen). Vendors: [Xen Project](https://junglewise.ai/threats/vendors/xen-project).

## Quick answers

**Is CVE-2026-62430 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-62430 being exploited in the wild.

**How severe is CVE-2026-62430?** Informational severity, with a CVSS score of 0, published 28 July 2026.

**Which products and versions are affected?** Xen Project Xen 3.2 through 4.19.x.

**Is there a fix for CVE-2026-62430?** A patch was published on 2026-07-28. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-62430 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-62430?** Check whether you run Xen Project Xen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A race condition exists in Xen's x86 vRTC emulation when accessing CMOS memory via indirect IO port pairs. The hypervisor caches a guest-chosen index but fails to implement necessary locking during certain operations. This allows a guest to modify the index after it has been validated but before it is used, resulting in a Time-of-Check Time-of-Use (TOCTOU) flaw that leads to an out-of-bounds read of Xen's internal array contents. The impact is limited to information disclosure of hypervisor data; it does not permit cross-guest data access. The vulnerability affects HVM guests; PV and PVH guests are not impacted.

## Affected products

- Xen Project Xen 3.2 through 4.19.x

## Timeline

- 2026-07-28: disclosed
- 2026-07-28: advisory
- 2026-07-28: patched

## References

- [https://xenbits.xenproject.org/xsa/advisory-503.html](https://xenbits.xenproject.org/xsa/advisory-503.html)

## Related threats

- [Xen arbitrary read/write via grant copy caching](https://junglewise.ai/threats/cve-2026-102704-this-cna-information-record-relates-to-multiple-cves-the-text)
- [Xen hypervisor arbitrary read/write via grant copy](https://junglewise.ai/threats/cve-2026-102703-this-cna-information-record-relates-to-multiple-cves-the-text)
- [Xen VMX VMentry failure with branch tracing and blocked states](https://junglewise.ai/threats/cve-2026-79611-for-xsa-308-logic-was-introduced-as-vmx-vmentry-checks-do-not)
- [Xen XPTI privilege escalation on huge-memory systems](https://junglewise.ai/threats/cve-2026-79609-xpti-xen-page-table-isolation-was-introduced-to-mitigate-meltdown)
- [Xen ineffectual Zenbleed workaround on AMD x86](https://junglewise.ai/threats/cve-2026-79608-the-workaround-for-xsa-433-zenbleed-was-later-re-worked-to-better)