Quick answers
- Is CVE-2026-62434 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-62434 being exploited in the wild.
- How severe is CVE-2026-62434?
- Informational severity, with a CVSS score of 0, published 28 July 2026.
- Which products and versions are affected?
- Xen Project Xen 3.4 and later.
- Is there a fix for CVE-2026-62434?
- A patch was published on 2026-07-28. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-62434 attacked?
- It is attacked with local access, in an operating system.
- Am I affected by CVE-2026-62434?
- Check whether you run Xen Project Xen at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A vulnerability in Xen's Populate on Demand (PoD) mechanism allows an x86 HVM or PVH guest to attempt to reclaim pages that are not regular guest RAM. This occurs when a guest is configured with a 'maxmem' value larger than its initial 'memory' allocation. By targeting special pages for reclamation, a malicious guest can corrupt the hypervisor's internal memory management state. This can lead to a Denial of Service (host crash), information leakage, or potential privilege escalation. The issue affects all Xen versions from 3.4 onwards on x86 architectures. A patch is available via XSA-507.
Affected products
- Xen Project Xen 3.4 and later
Timeline
- 2026-07-28: disclosed
- 2026-07-28: advisory
- 2026-07-28: patched