This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] Some Viridian hypercalls can specify a mask of vCPU IDs as an input, in one of three formats. Xen has boundary checking bugs with all three formats, which can cause out-of-bounds reads and writes while processing the inputs. * CVE-2025-58147. Hypercalls using the HV_VP_SET Sparse format can cause vpmask_set() to write out of bounds when converting the bitmap to Xen's format. * CVE-2025-58148. Hypercalls using any input format can cause send_ipi() to read d->vcpu[] out-of-bounds, and operate on a wild vCPU pointer.
| Link | Resource |
|---|---|
| https://xenbits.xenproject.org/xsa/advisory-475.html | Patch Vendor Advisory |
| http://www.openwall.com/lists/oss-security/2025/10/21/1 | Mailing List Patch Third Party Advisory |
| http://xenbits.xen.org/xsa/advisory-475.html | Patch Vendor Advisory |
14 Jan 2026, 22:03
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Xen
Xen xen |
|
| CPE | cpe:2.3:o:xen:xen:*:*:*:*:*:*:*:* | |
| References | () https://xenbits.xenproject.org/xsa/advisory-475.html - Patch, Vendor Advisory | |
| References | () http://www.openwall.com/lists/oss-security/2025/10/21/1 - Mailing List, Patch, Third Party Advisory | |
| References | () http://xenbits.xen.org/xsa/advisory-475.html - Patch, Vendor Advisory |
04 Nov 2025, 22:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
03 Nov 2025, 18:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
31 Oct 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-125 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
31 Oct 2025, 12:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Published : 2025-10-31 12:15
Updated : 2026-01-14 22:03
NVD link : CVE-2025-58147
Mitre link : CVE-2025-58147
CVE.ORG link : CVE-2025-58147
JSON object : View
Out-of-bounds Read