Vulnerability · Published Jul 9, 2026 · Assigned by XEN

CVE-2025-27464WinPVDrivers: Excessive permissions on user-exposed devices

Critical 9.4

In plain English

A critical-severity incorrect default permissions in Windows PV drivers from Xen. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).

Severity (CVSS 4.0)9.4Critical

Exploit odds (30 days)0.2%top 95.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windows PV drivers expose various facilities to userspace. Several of these have no security descriptor, and are therefore fully accessible to unprivileged users. These are: 1. XenCons, CVE-2025-27462 2. XenIface, CVE-2025-27463 3. XenBus, CVE-2025-27464

Affected products (as reported)

Vendor	Product	Versions
Xen	Windows PV drivers	all

Weakness: CWE-276 · Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

https://xenbits.xen.org/xsa/advisory-468.html