Two memory-handling vulnerabilities in the Xen hypervisor, CVE-2026-102703 and CVE-2026-102704, allow guest virtual machines to read and write memory across shared hosts.
Developers and system administrators running Xen versions 4.6 and above should review advisory XSA-523 and apply available patches or distro updates.
According to the official update published on November 3, the issue affects all versions of Xen from 4.6 onwards, while older versions 4.5 and below are not affected. These vulnerabilities were initially discovered with the help of Anthropic's Claude artificial intelligence, verified by a researcher at Ada Logics, and independently reported by the CodeAnt AI security research team.
Who is at risk and what are the consequences?
The Xen-based XCP-ng platform warned that a compromised virtual machine could exceed its isolation limits and take complete control of the entire host. Qubes OS also said that every supported version and configuration of its operating system is affected.
So far, the Xen update doesn't mention any attacks that have exploited the vulnerabilities in practice, nor does it specify what kind of access someone would need to access the machine. However, because the problem is widespread, software distributors have begun to take action.
What do the available solutions show?
There are fixes for Xen versions 4.17 and later, while versions 4.6 through 4.16 do not have a fix. The XCP-ng platform has released an update that requires a reboot of the hosts, while Qubes OS offers a workaround for version 4.3 that requires a reboot and additional actions for some users.
↳
READ ALSO
HACKS.GR / RELATED
Vulnerabilities & Security Updates
Google fixes serious issue in Android 14 to 17 that allowed remote intervention
↗
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
Top comments (0)