CVE-2025-27464
CriticalCVSS 9.4Summary
CVE-2025-27464 affects the XenBus driver for Windows, which lacks a security descriptor, allowing unprivileged users full access to its facilities.
Risk Assessment
The risk is that an unprivileged user could exploit the XenBus driver to escalate privileges or disrupt system operations, potentially compromising confidentiality, integrity, or availability.
Recommendation
It is recommended to immediately apply patches provided by the vendor and restrict access to the XenBus driver through appropriate security configurations.
Original NVD description (English source)
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windows PV drivers expose various facilities to userspace. Several of these have no security descriptor, and are therefore fully accessible to unprivileged users. These are: 1. XenCons, CVE-2025-27462 2. XenIface, CVE-2025-27463 3. XenBus, CVE-2025-27464