CVE-2025-27462
CriticalCVSS 9.4Summary
The Windows PV drivers (XenCons) lack a security descriptor, allowing unprivileged users full access to the facilities exposed by this component.
Risk Assessment
The organization is exposed to unauthorized access to critical system functions, potentially leading to privilege escalation and compromise of the virtualization environment integrity.
Recommendation
Immediately apply the Windows PV driver update provided by the vendor and verify the security descriptor configuration for all Xen components.
Original NVD description (English source)
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windows PV drivers expose various facilities to userspace. Several of these have no security descriptor, and are therefore fully accessible to unprivileged users. These are: 1. XenCons, CVE-2025-27462 2. XenIface, CVE-2025-27463 3. XenBus, CVE-2025-27464