VSA-2026-025: buffer overruns in libfsimage iso9660 handling (CVE-2026-42494, CVE-2026-42495, CVE-2026-62423, CVE-2026-62424, CVE-2026-62425 / XSA-497)
| Published | Updated | Severity | CVSS 4.0 | Affected products |
|---|---|---|---|---|
| 2027-07-28 | 2027-07-28 | 🟠Moderate | Not available yet | - XCP-ng 8.3 |
Multiple buffer overrun vulnerabilities in the Xen project's libfsimage iso9660 driver have been discovered. For Vates products, we classify the impact as Moderate: a guest using pygrub can escalate its privilege, but the de-privileged mode introduced by XSA-443 mitigates this risk. For details on how we assign severity levels, see our Severity Levels Explained page.
Summary​
The directory and Rock Ridge / SUSP walk in libfsimage's iso9660 driver derives several lengths directly from attacker-controlled on-disk fields without validating them:
- The directory loop itself assumes a good record length (CVE-2026-42494)
- The calculation of the System Use area may underflow (CVE-2026-42495)
- The Rock Ridge extension loop assumes a good (inner) record length (CVE-2026-62423)
- The Rock Ridge NM record processing assumes a good entry length (CVE-2026-62424)
- The Rock Ridge CE record processing assumes a good size and offset (CVE-2026-62425)
Impact​
A guest using pygrub can escalate its privilege to that of the domain construction tools (i.e., normally, to control of the host). If the mechanism introduced by XSA-443 (de-privileged pygrub mode) is in use, then the guest can only escalate to this limited context.
Affected Versions​
- XCP-ng 8.3: Affected, but only in case of PV or PV-in-PVH guests. HVM guests are not impacted.
Mitigation​
XCP-ng already runs pygrub de-privileged, limiting the possible privilege escalation. Using this mode will mitigate the vulnerability. Ensuring that guests do not use the pygrub bootloader will avoid this vulnerability. For cases where the PV guest is known to be 64-bit and uses grub2 as a bootloader, pvgrub is a suitable alternative. Running only HVM or PVH guests will avoid the vulnerability.
Resolution​
As of 2027-07-28, the updated xen-* packages for XCP-ng 8.3 have been updated to address this issue.
List of packages fixing this issue:
- XCP-ng 8.3:
4.17.6-9.3.1.xcpng8.3