CVE-2025-27463
CriticalCVSS 9.4Summary
CVE-2025-27463 affects the XenIface driver in Windows PV drivers. The lack of a security descriptor allows unprivileged users full access to this interface.
Risk Assessment
The organization is at risk of unauthorized access to XenIface driver functions, potentially leading to privilege escalation or system integrity compromise.
Recommendation
Immediately apply the Windows PV drivers update provided by the vendor and restrict access to the XenIface interface through appropriate security rules.
Original NVD description (English source)
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windows PV drivers expose various facilities to userspace. Several of these have no security descriptor, and are therefore fully accessible to unprivileged users. These are: 1. XenCons, CVE-2025-27462 2. XenIface, CVE-2025-27463 3. XenBus, CVE-2025-27464