CVE-2026-62434 | A guest started with Populated on Demand enabled (PoD) can a… | CVSS 5.3 MEDIUM

Description

A guest started with Populated on Demand enabled (PoD) can attempt to reclaim pages which aren't regular guest RAM. This can cause corruption of memory management state in Xen.

Metadata

CVE ID: CVE-2026-62434
State: PUBLISHED
Assigner: XEN
Reserved: 2026-07-14 10:28 UTC
Published: 2026-07-28 12:33 UTC
Last updated: 2026-07-28 16:33 UTC
Primary CWE: CWE-787
CWE-787 Out-of-bounds Write
Vendor / Product: Xen / Xen
Sources: cve.org · NVD

Severity & Metrics

5.3 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

SSVC — CISA Coordinator

Exploitation: none
Automatable: yes
Tech. Impact: partial

Affected products (1)

Vendor	Product	Platform	Versions
Xen	Xen	—	consult Xen advisory XSA-507

Weakness (CWE)

CWE	Source	Description
CWE-787	adp	CWE-787 Out-of-bounds Write

CVSS scores (1)

Score	Severity	Version	Source	Vector
5.3	MEDIUM	3.1	adp	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References (1)

https://xenbits.xenproject.org/xsa/advisory-507.html