VSA-2026-030: out-of-bounds read in vRTC emulation (CVE-2026-62430 / XSA-503)
| Published | Updated | Severity | CVSS 4.0 | Affected products |
|---|---|---|---|---|
| 2026-07-28 | 2026-07-28 | 🟠Moderate | Not available yet | - XCP-ng 8.3 |
An out-of-bounds read vulnerability in the Xen hypervisor's vRTC emulation has been discovered. For Vates products, we classify the impact as Moderate, as an attacker can read out-of-bounds, limited to Xen data and not data belonging to other guests. For details on how we assign severity levels, see our Severity Levels Explained page.
Summary​
Accesses to the CMOS memory contents are done using an indirect IO port pair. Therefore Xen needs to cache the guest chosen index, and one of the usages of the index didn't take the necessary locking to avoid concurrent changes. As a result, a guest could change the index after it being checked, causing a subsequent out-of-bound read access to the contents of an array.
Impact​
An attacker can read out-of-bounds. This is limited to Xen data, and not data belonging to other guests.
Affected Versions​
- XCP-ng 8.3: Affected.
Mitigation​
Running only PV or PVH guests will avoid the vulnerability.
Resolution​
As of 2026-07-28, the updated xen-* packages for XCP-ng 8.3 have been updated to address this issue.
List of packages fixing this issue:
- XCP-ng 8.3:
4.17.6-9.3.1.xcpng8.3