Windows PV XenDrv Unrestricted Access via XenIface
CVE-2025-27463 Published on July 9, 2026

WinPVDrivers: Excessive permissions on user-exposed devices
[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] The Windows PV drivers expose various facilities to userspace. Several of these have no security descriptor, and are therefore fully accessible to unprivileged users. These are: 1. XenCons, CVE-2025-27462 2. XenIface, CVE-2025-27463 3. XenBus, CVE-2025-27464

NVD

Weakness Type

Incorrect Default Permissions

During installation, installed file permissions are set to allow anyone to modify those files.


Affected Versions

Xen Windows PV drivers Version all is affected by CVE-2025-27463

Exploit Probability

EPSS
0.16%
Percentile
5.37%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.