Citrix XenServer Vulnerabilities Could Allow Malicious VM Users to Compromise Host Systems
Citrix disclosed four XenServer flaws that may let privileged guest users compromise or crash the host.
62
Vulnerability3 · 2 reads
CVE-2026-79610
Stale grant-table pointers in Xen may enable host compromise
- CVSS 3.1
- 8.8 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-79610 is a Xen hypervisor flaw in grant-table version switching, described as a follow-on to XSA-501. A change from grant-table version 2 to version 1 and back to version 2 frees status pages and then allocates them again, so pointers into the status array calculated before that pair of changes can become stale. Use of those stale pointers can corrupt hypervisor state and, per related Citrix reporting, may let a malicious virtual-machine user compromise the host. Xen deployments and Citrix XenServer systems that include the affected grant-table code are in scope, but exact version ranges were not in the supplied data. No public proof of concept is known and the issue is not in CISA KEV, so exploitation is not known.
What to do: Apply the Xen project fix for this XSA-501 follow-on and the Citrix XenServer updates in advisory AV26-1034 as soon as they are available for your branch. Until hosts are patched, do not place untrusted guests on shared hypervisors. Confirm the corrected build from your vendor advisory; no fixed version numbers were included in the supplied data.
| Product | Affected |
|---|---|
| Xen Project Xen hypervisor | — |
| Citrix XenServer | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
XSA-501 was about issues with v1 -> v2 and v2 -> v1 changes racing certain other grant table operations. Sadly a v2 -> v1 -> v2 change has yet another effect which wasn't accounted for: During the first change, status pages would be freed. During the second change they would be allocated again. Hence across the full pair of change the addresses of the status pages may change, rendering stale previously calculated pointers into the status array.
- Weakness
- CWE-362
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
In the news
3 storiesCitrix Patches XenServer Vulnerabilities That Could Enable Host Compromise
Citrix patched four XenServer flaws, three of which could let a privileged guest compromise or crash the host.
62
Citrix security advisory (AV26-1034)
Canada's Cyber Centre urges updates for Citrix UniconOS and XenServer flaws listed in AV26-1034.
32