CVE-2026-23557

Published: May 19, 2026Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

Exploitability: 2.0 / Impact: 4.0

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

Any guest can cause xenstored to crash by issuing a XS_RESET_WATCHES command within a transaction due to an assert() triggering. In case xenstored was built with NDEBUG #defined nothing bad will happen, as assert() is doing nothing in this case. Note that the default is not to define NDEBUG for xenstored builds even in release builds of Xen.

Affected (1)

Products: Xen: Xen

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Xen Xen	From 4.2.0

Related CWEs

Reachable Assertion

The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.

References (3)

https://xenbits.xenproject.org/xsa/advisory-484.html

Source: security@xen.org

PatchVendor Advisory

http://www.openwall.com/lists/oss-security/2026/04/28/11

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListPatchThird Party Advisory

http://xenbits.xen.org/xsa/advisory-484.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.