CVE-2026-23557

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23557
Any guest can cause xenstored to crash by issuing a XS_RESET_WATCHES command within a transaction due to an assert() triggering. In case xenstored was built with NDEBUG #defined nothing bad will happen, as assert() is doing nothing in this case. Note that the default is not to define NDEBUG for xenstored builds even in release builds of Xen.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.0 / Impact : 4.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://xenbits.xenproject.org/xsa/advisory-484.html Patch Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/04/28/11 Mailing List Patch Third Party Advisory
http://xenbits.xen.org/xsa/advisory-484.html Patch Vendor Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*
History

19 May 2026, 18:56

Type Values Removed Values Added
First Time Xen xen
Xen
References () https://xenbits.xenproject.org/xsa/advisory-484.html - () https://xenbits.xenproject.org/xsa/advisory-484.html - Patch, Vendor Advisory
References () http://www.openwall.com/lists/oss-security/2026/04/28/11 - () http://www.openwall.com/lists/oss-security/2026/04/28/11 - Mailing List, Patch, Third Party Advisory
References () http://xenbits.xen.org/xsa/advisory-484.html - () http://xenbits.xen.org/xsa/advisory-484.html - Patch, Vendor Advisory
CPE cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:*

19 May 2026, 16:16

Type Values Removed Values Added
CWE CWE-617
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5

19 May 2026, 14:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-05-19 14:16

Updated : 2026-05-19 18:56

NVD link : CVE-2026-23557

Mitre link : CVE-2026-23557

CVE.ORG link : CVE-2026-23557

JSON object : View

Products Affected

xen

  • xen
CWE
CWE-617

Reachable Assertion