Is CVE-2026-62437 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-62437 being exploited in the wild.

How severe is CVE-2026-62437?

Medium severity, with a CVSS score of 6.5, published 8 September 2026.

Is there a fix for CVE-2026-62437?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-62437 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2026-62437?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62437: Xen hypervisor memory leak in IRQ tracking during guest cleanup

CVE-2026-62437 · Severity: medium · CVSS 6.5 · Published 2026-09-08

Xen is a hypervisor platform that runs multiple virtual machines (guests) on a single physical server. When a virtual machine with assigned PCI devices is shut down, the hypervisor fails to properly clean up all memory structures associated with device interrupts, allowing a malicious guest to exhaust the hypervisor's memory and crash the entire system. This affects all organizations running Xen-based cloud infrastructure or virtualized servers.

Quick answers

Is CVE-2026-62437 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-62437 being exploited in the wild.
How severe is CVE-2026-62437?: Medium severity, with a CVSS score of 6.5, published 8 September 2026.
Which products and versions are affected?: Xen Xen 3.2 and later.
Is there a fix for CVE-2026-62437?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-62437 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2026-62437?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is a resource leak (CWE-400) in Xen's PCI device passthrough teardown logic. When an HVM guest with assigned PCI devices is terminated, IRQ tracking structures are cleaned up early in the shutdown process. However, the guest's device model can re-establish these tracking structures by binding IRQs again before final cleanup occurs, leaving at least one tracking structure unreleased. An attacker with control of an HVM guest can repeatedly trigger this condition to leak hypervisor memory, eventually causing denial of service of the host and all co-resident guests. The attack requires only that the guest have at least one PCI device assigned. A patch is available and applying xsa509.patch resolves the issue.

Affected products

Xen Xen 3.2 and later

Timeline

2026-09-08: disclosed
other: XSA-509 public release

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.