# Xen Project vulnerabilities Source: https://junglewise.ai/threats/vendors/xen-project Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/xen-project.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 49 vulnerabilities in Xen Project: 0 in the last 7 days and 7 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-102704, was published on 4 November 2026. 7 vulnerabilities in the last four weeks, up from none in the four before. 2 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 2 - Last 90 days: 7 - All time: 49 (0 critical, 0 exploited in the wild) ## About Xen Project An open-source project that develops the Xen hypervisor and related virtualization technologies. ## Latest Xen Project vulnerabilities - [CVE-2026-102704: Xen arbitrary read/write via grant copy caching](https://junglewise.ai/threats/cve-2026-102704-this-cna-information-record-relates-to-multiple-cves-the-text) (info, published 4 Nov 2026) - [CVE-2026-102703: Xen hypervisor arbitrary read/write via grant copy](https://junglewise.ai/threats/cve-2026-102703-this-cna-information-record-relates-to-multiple-cves-the-text) (info, published 4 Nov 2026) - [CVE-2026-79611: Xen VMX VMentry failure with branch tracing and blocked states](https://junglewise.ai/threats/cve-2026-79611-for-xsa-308-logic-was-introduced-as-vmx-vmentry-checks-do-not) (info, published 13 Oct 2026) - [CVE-2026-79609: Xen XPTI privilege escalation on huge-memory systems](https://junglewise.ai/threats/cve-2026-79609-xpti-xen-page-table-isolation-was-introduced-to-mitigate-meltdown) (info, published 13 Oct 2026) - [CVE-2026-79608: Xen ineffectual Zenbleed workaround on AMD x86](https://junglewise.ai/threats/cve-2026-79608-the-workaround-for-xsa-433-zenbleed-was-later-re-worked-to-better) (info, published 13 Oct 2026) - [CVE-2026-102702: Xen hypervisor cache flush denial of service and memory corruption](https://junglewise.ai/threats/cve-2026-102702-this-cna-information-record-relates-to-multiple-cves-the-text) (info, published 13 Oct 2026) - [CVE-2026-102700: Xen gnttab cache-flush page reference leak](https://junglewise.ai/threats/cve-2026-102700-with-its-original-introduction-gnttab-cache-flush-was-made) (info, published 13 Oct 2026) - [CVE-2026-62436: Xen grant table race condition in version switching](https://junglewise.ai/threats/cve-2026-62436-xen-grant-table-race-condition-in-version-switching) (info, CVSS 0, published 28 Jul 2026) - [CVE-2026-62435: Xen grant table race condition in version switching](https://junglewise.ai/threats/cve-2026-62435-xen-grant-table-race-condition-in-version-switching) (info, CVSS 8.8, published 28 Jul 2026) - [CVE-2026-62434: Xen memory management state corruption in Populate on Demand](https://junglewise.ai/threats/cve-2026-62434-xen-memory-management-state-corruption-in-populate-on-demand) (info, CVSS 0, published 28 Jul 2026) - [CVE-2026-62433: Xen DM_OP missing buffer validation in hypercalls](https://junglewise.ai/threats/cve-2026-62433-xen-dm-op-missing-buffer-validation-in-hypercalls) (info, CVSS 0, published 28 Jul 2026) - [CVE-2026-62432: Xen race condition in FIFO event channel expansion](https://junglewise.ai/threats/cve-2026-62432-xen-race-condition-in-fifo-event-channel-expansion) (info, CVSS 0, published 28 Jul 2026) - [CVE-2026-62431: Xen Viridian STIMER division by zero denial of service](https://junglewise.ai/threats/cve-2026-62431-xen-viridian-stimer-division-by-zero-denial-of-service) (info, CVSS 6.8, published 28 Jul 2026) - [CVE-2026-62430: Xen x86 out-of-bounds read in vRTC emulation](https://junglewise.ai/threats/cve-2026-62430-xen-x86-out-of-bounds-read-in-vrtc-emulation) (info, CVSS 0, published 28 Jul 2026) - [CVE-2026-62429: Xen vNUMA race condition during domain destruction](https://junglewise.ai/threats/cve-2026-62429-xen-vnuma-race-condition-during-domain-destruction) (info, CVSS 0, published 28 Jul 2026) - [CVE-2026-62428: Xen grant-table type confusion in grant-copy](https://junglewise.ai/threats/cve-2026-62428-xen-grant-table-type-confusion-in-grant-copy) (info, CVSS 8.8, published 28 Jul 2026) - [CVE-2026-62427: Xen Project denial of service in platform-op locks](https://junglewise.ai/threats/cve-2026-62427-xen-project-denial-of-service-in-platform-op-locks) (info, CVSS 0, published 28 Jul 2026) - [CVE-2026-62426: Xen Project Xen denial of service via unfair sysctl and platform-op locks](https://junglewise.ai/threats/cve-2026-62426-xen-project-xen-denial-of-service-via-unfair-sysctl-and-platform) (info, CVSS 0, published 28 Jul 2026) - [CVE-2026-62425: Xen libfsimage buffer overflow in Rock Ridge CE record processing](https://junglewise.ai/threats/cve-2026-62425-xen-libfsimage-buffer-overflow-in-rock-ridge-ce-record-processing) (info, CVSS 8.8, published 28 Jul 2026) - [CVE-2026-62424: Xen libfsimage buffer overrun in Rock Ridge NM record processing](https://junglewise.ai/threats/cve-2026-62424-xen-libfsimage-buffer-overrun-in-rock-ridge-nm-record-processing) (info, CVSS 0, published 28 Jul 2026) - [CVE-2026-62423: Xen libfsimage buffer overrun in Rock Ridge extension loop](https://junglewise.ai/threats/cve-2026-62423-xen-libfsimage-buffer-overrun-in-rock-ridge-extension-loop) (info, CVSS 0, published 28 Jul 2026) - [CVE-2026-42495: Xen libfsimage integer underflow in iso9660 System Use area calculation](https://junglewise.ai/threats/cve-2026-42495-xen-libfsimage-integer-underflow-in-iso9660-system-use-area) (info, CVSS 8.8, published 28 Jul 2026) - [CVE-2026-42494: Xen libfsimage buffer overruns in iso9660 handling](https://junglewise.ai/threats/cve-2026-42494-xen-libfsimage-buffer-overruns-in-iso9660-handling) (info, CVSS 0, published 28 Jul 2026) - [CVE-2026-42493: Xen Project Denial of Service in x86 shadow paging](https://junglewise.ai/threats/cve-2026-42493-xen-project-denial-of-service-in-x86-shadow-paging) (info, published 28 Jul 2026) - [CVE-2026-42492: Xen vIRQ event channel binding error in Xenstore](https://junglewise.ai/threats/cve-2026-42492-xen-virq-event-channel-binding-error-in-xenstore) (info, CVSS 6.5, published 28 Jul 2026) ## Most severe Xen Project vulnerabilities - [CVE-2016-9383: Xen broken bit test instruction emulation memory corruption](https://junglewise.ai/threats/cve-2016-9383-xen-broken-bit-test-instruction-emulation-memory-corruption) (high, CVSS 8.8, published 23 Jan 2017) - [CVE-2026-42488: Xen x86 mapcache corruption in shadow paging error paths](https://junglewise.ai/threats/cve-2026-42488-xen-x86-mapcache-corruption-in-shadow-paging-error-paths) (high, CVSS 8.1, published 18 Jun 2026) - [CVE-2026-42487: Xen x86 HVM race condition in I/O port list traversal](https://junglewise.ai/threats/cve-2026-42487-xen-x86-hvm-race-condition-in-i-o-port-list-traversal) (high, CVSS 7.9, published 18 Jun 2026) - [CVE-2016-9379: Xen pygrub delimiter injection in S-expression output](https://junglewise.ai/threats/cve-2016-9379-xen-pygrub-delimiter-injection-in-s-expression-output) (high, CVSS 7.9, published 23 Jan 2017) - [CVE-2016-10013: Xen privilege escalation via SYSCALL singlestep emulation](https://junglewise.ai/threats/cve-2016-10013-xen-privilege-escalation-via-syscall-singlestep-emulation) (high, CVSS 7.8, published 26 Jan 2017) - [CVE-2016-9386: Xen x86 emulator privilege escalation via NULL segment handling](https://junglewise.ai/threats/cve-2016-9386-xen-x86-emulator-privilege-escalation-via-null-segment-handling) (high, CVSS 7.8, published 23 Jan 2017) - [CVE-2016-9382: Xen x86 task switch privilege escalation in VM86 mode](https://junglewise.ai/threats/cve-2016-9382-xen-x86-task-switch-privilege-escalation-in-vm86-mode) (high, CVSS 7.8, published 23 Jan 2017) - [CVE-2016-9381: Xen QEMU race condition in shared ring processing](https://junglewise.ai/threats/cve-2016-9381-xen-qemu-race-condition-in-shared-ring-processing) (high, CVSS 7.5, published 23 Jan 2017) - [CVE-2016-9380: Xen pygrub arbitrary file read and deletion via delimiter injection](https://junglewise.ai/threats/cve-2016-9380-xen-pygrub-arbitrary-file-read-and-deletion-via-delimiter) (high, CVSS 7.5, published 23 Jan 2017) - [CVE-2025-54518: AMD Zen 2 Processors privilege escalation via CPU Opcode Cache corruption](https://junglewise.ai/threats/cve-2025-54518-amd-zen-2-processors-privilege-escalation-via-cpu-opcode-cache) (high, CVSS 7, published 15 May 2026) ## Vulnerabilities per week 7 vulnerabilities in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 5 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 2 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Xen Project technologies - [Xen Project Xen](https://junglewise.ai/threats/technologies/xen): 47 vulnerabilities - [Xen Project Windows PV drivers](https://junglewise.ai/threats/technologies/windows-pv-drivers): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Xen Project vulnerabilities", https://junglewise.ai/threats/vendors/xen-project, 13 November 2026.