CVE-2025-27463criticalCWE-276

CVE-2025-27463: critical vulnerability in Xen Windows PV drivers

WinPVDrivers: Excessive permissions on user-exposed devices

Published

Follow this CVE+ Monitor Windows PV drivers

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.4epss 0.2%
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windows PV drivers expose various facilities to userspace. Several of these have no security descriptor, and are therefore fully accessible to unprivileged users. These are: 1. XenCons, CVE-2025-27462 2. XenIface, CVE-2025-27463 3. XenBus, CVE-2025-27464
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products
Xen · Windows PV drivers
Related CVEs — Xen Windows PV drivers

In the same product, most dangerous first.

CVE-2025-27464CRITICALWinPVDrivers: Excessive permissions on user-exposed devicesEPSS 0.2%CVE-2025-27462CRITICALWinPVDrivers: Excessive permissions on user-exposed devicesEPSS 0.2%