CVE-2026-62433 correct buffer checks for DM_OP hypercalls
A missing buffer check in Xen hypervisor DM_OP handling allows attackers to access uninitialized stack memory, potentially leading to code execution or crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-62433?
CVE-2026-62433 is a high-severity memory corruption vulnerability in Xen, published on 28 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Parts of the DM_OP handling code assumes the caller has provided the required number of buffers for the given operation without any checking being done. As a result, certain operations might access stack rubble as structures are possibly uninitialized.
Weakness: CWE-665
Which versions are affected by CVE-2026-62433?
How do I fix CVE-2026-62433?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-62433 being exploited?
There is no known exploitation of CVE-2026-62433 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2026-62433, DEBIAN-CVE-2026-62433, GHSA-cfmp-p477-x9qv, UBUNTU-CVE-2026-62433.