CVE-2026-62434 Details
Description
A guest started with Populated on Demand enabled (PoD) can attempt to reclaim pages which aren't regular guest RAM. This can cause corruption of memory management state in Xen.
A vulnerability exists in Xen hypervisor versions 3.4 and later, specifically on x86 systems. When a guest is started with Populated on Demand (PoD) enabled, it can attempt to reclaim non-standard guest memory pages. This behavior can lead to corruption of Xen's memory management state, potentially causing system crashes or malfunctions. While the primary issue is memory corruption, there is a possibility of an information leak or privilege escalation.
The vulnerability can be resolved by applying the provided patch. For released Xen versions, this patch should be applied to the stable branches. Note that after applying the patch, downstreams should update to the latest stable branch tip.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 28, 2026CISA-ADP
Assessed Jul 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2026/07/28/23 | CVE | |
| http://xenbits.xen.org/xsa/advisory-507.html | CVE | |
| https://xenbits.xenproject.org/xsa/advisory-507.html | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Xen | >= 3.4 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 28, 2026 | CVE Modified | CVE |
| Jul 28, 2026 | CVE Modified | CISA-ADP |
| Jul 28, 2026 | CVE Modified | CVE |
| Jul 28, 2026 | New CVE Received | [email protected] |