VSA-2026-033: incorrect buffer checks for DM_OP hypercalls (CVE-2026-62433 / XSA-506)
| Published | Updated | Severity | CVSS 4.0 | Affected products |
|---|---|---|---|---|
| 2026-07-28 | 2026-07-28 | 🟢 Low | Not available yet | - XCP-ng 8.3 |
A buffer validation vulnerability in the Xen hypervisor's DM_OP hypercall handling has been discovered. For Vates products, we classify the impact as Low, as the vulnerability is not directly exploitable. For details on how we assign severity levels, see our Severity Levels Explained page.
Summary​
Parts of the DM_OP handling code assume the caller has provided the required number of buffers for the given operation without any checking being done. As a result, certain operations might access stack rubble as structures are possibly uninitialized.
Impact​
A device model of a HVM guest can gain insight on the contents of the Xen stack, thus possibly leaking data from other guests' contexts.
Affected Versions​
- XCP-ng 8.3: Affected, but XCP-ng doesn't use stub domains.
Mitigation​
Running only PV or PVH guests will avoid the vulnerability.
Resolution​
As of 2026-07-28, fix for this low severity vulnerability is not yet integrated in XCP-ng 8.3 packages.