Quick answers
- Is CVE-2026-62433 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-62433 being exploited in the wild.
- How severe is CVE-2026-62433?
- Informational severity, with a CVSS score of 0, published 28 July 2026.
- Which products and versions are affected?
- Xen Project Xen 4.10 onwards.
- Is there a fix for CVE-2026-62433?
- A patch was published on 2026-07-28: Patch xsa506.patch released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-62433 attacked?
- It is attacked with local access, in an operating system.
- Am I affected by CVE-2026-62433?
- Check whether you run Xen Project Xen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A vulnerability exists in the Xen hypervisor's DM_OP (Device Model Operation) handling logic. The code assumes the caller has provided the required number of buffers for a given operation without performing explicit bounds or count checking. Consequently, certain operations may access 'stack rubble'—uninitialized data residing on the Xen kernel stack. An attacker controlling a device model (such as a de-privileged QEMU process in Dom0 or a stub domain) for an HVM guest can exploit this to leak sensitive information from the Xen stack, potentially including data belonging to other guest contexts. The issue is addressed in XSA-506 via a patch that implements proper buffer count validation.
Affected products
- Xen Project Xen 4.10 onwards
Timeline
- 2026-07-28: disclosed: Public release of XSA-506
- 2026-07-28: patched: Patch xsa506.patch released
- 2026-07-28: advisory: NVD publication date