CVE-2026-62434 - Vulnerability Details - OpenCVE

A guest started with Populated on Demand enabled (PoD) can attempt to reclaim pages which aren't regular guest RAM. This can cause corruption of memory management state in Xen.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable yes

Technical Impact partial

No data.

No data.

No data.

No data.

References

Link	Providers
https://xenbits.xenproject.org/xsa/advisory-507.html

History

Tue, 28 Jul 2026 16:15:00 +0000

Type	Values Removed	Values Added
Description		A guest started with Populated on Demand enabled (PoD) can attempt to reclaim pages which aren't regular guest RAM. This can cause corruption of memory management state in Xen.
Title		PoD: Don't try to reclaim special pages
Weaknesses		CWE-787
References		https://xenbits.xenproject.org/xsa/advisory-507.html
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}` ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: XEN

Published: 2026-07-28T12:33:08.540Z

Updated: 2026-07-28T16:33:34.668Z

Reserved: 2026-07-14T10:28:12.655Z

Link: CVE-2026-62434

Vulnrichment

Updated: 2026-07-28T16:33:34.668Z

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-62434", "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "state": "PUBLISHED", "assignerShortName": "XEN", "dateReserved": "2026-07-14T10:28:12.655Z", "datePublished": "2026-07-28T12:33:08.540Z", "dateUpdated": "2026-07-28T16:33:34.668Z"}, "containers": {"cna": {"title": "PoD: Don't try to reclaim special pages", "datePublic": "2026-07-28T12:00:00.000Z", "descriptions": [{"lang": "en", "value": "A guest started with Populated on Demand enabled (PoD) can attempt to\nreclaim pages which aren't regular guest RAM. This can cause corruption\nof memory management state in Xen."}], "impacts": [{"descriptions": [{"lang": "en", "value": "A buggy or malicious guest can cause corruption of Xen's state, leading\nto crashes or other malfunctions. Information leak and privilege\nescalation cannot be ruled out."}]}], "affected": [{"defaultStatus": "unknown", "product": "Xen", "vendor": "Xen", "versions": [{"status": "unknown", "version": "consult Xen advisory XSA-507"}]}], "configurations": [{"lang": "en", "value": "All Xen versions from 3.4 onwards are vulnerable. Xen versions 3.3 and\nearlier are not vulnerable.\n\nOnly x86 systems are vulnerable.\n\nOnly x86 HVM and PVH guests started in populate-on-demand mode are\nbelieved to be able to leverage the vulnerability. Populate-on-demand\nmode is activated when the guest's xl configuration file specifies a\n\"maxmem\" value which is larger than the \"memory\" value."}], "workarounds": [{"lang": "en", "value": "Running only PV guests or HVM/PVH guests without PoD will avoid the\nvulnerability."}], "references": [{"url": "https://xenbits.xenproject.org/xsa/advisory-507.html"}], "providerMetadata": {"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "shortName": "XEN", "dateUpdated": "2026-07-28T12:33:08.540Z"}}, "adp": [{"title": "CVE Program Container", "references": [{"url": "http://xenbits.xen.org/xsa/advisory-507.html"}, {"url": "http://www.openwall.com/lists/oss-security/2026/07/28/23"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-07-28T16:33:34.668Z"}}, {"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-787", "lang": "en", "description": "CWE-787 Out-of-bounds Write"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2026-07-28T14:59:52.970334Z", "id": "CVE-2026-62434", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-28T15:00:00.728Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "http://xenbits.xen.org/xsa/advisory-507.html"}, {"url": "http://www.openwall.com/lists/oss-security/2026/07/28/23"}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-07-28T16:33:34.668Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-62434", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-28T14:59:52.970334Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-28T14:59:13.270Z"}}], "cna": {"title": "PoD: Don't try to reclaim special pages", "impacts": [{"descriptions": [{"lang": "en", "value": "A buggy or malicious guest can cause corruption of Xen's state, leading\nto crashes or other malfunctions. Information leak and privilege\nescalation cannot be ruled out."}]}], "affected": [{"vendor": "Xen", "product": "Xen", "versions": [{"status": "unknown", "version": "consult Xen advisory XSA-507"}], "defaultStatus": "unknown"}], "datePublic": "2026-07-28T12:00:00.000Z", "references": [{"url": "https://xenbits.xenproject.org/xsa/advisory-507.html"}], "workarounds": [{"lang": "en", "value": "Running only PV guests or HVM/PVH guests without PoD will avoid the\nvulnerability."}], "descriptions": [{"lang": "en", "value": "A guest started with Populated on Demand enabled (PoD) can attempt to\nreclaim pages which aren't regular guest RAM. This can cause corruption\nof memory management state in Xen."}], "configurations": [{"lang": "en", "value": "All Xen versions from 3.4 onwards are vulnerable. Xen versions 3.3 and\nearlier are not vulnerable.\n\nOnly x86 systems are vulnerable.\n\nOnly x86 HVM and PVH guests started in populate-on-demand mode are\nbelieved to be able to leverage the vulnerability. Populate-on-demand\nmode is activated when the guest's xl configuration file specifies a\n\"maxmem\" value which is larger than the \"memory\" value."}], "providerMetadata": {"orgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "shortName": "XEN", "dateUpdated": "2026-07-28T12:33:08.540Z"}}}, "cveMetadata": {"cveId": "CVE-2026-62434", "state": "PUBLISHED", "dateUpdated": "2026-07-28T16:33:34.668Z", "dateReserved": "2026-07-14T10:28:12.655Z", "assignerOrgId": "23aa2041-22e1-471f-9209-9b7396fa234f", "datePublished": "2026-07-28T12:33:08.540Z", "assignerShortName": "XEN"}, "dataVersion": "5.2"}