CVE-2026-23557CWE-617

CVE-2026-23557

Medium · published May 19, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
4.5
In the wild
Unconfirmed
What it is

Any guest can cause xenstored to crash by issuing a XS_RESET_WATCHES

command within a transaction due to an assert() triggering.

In case xenstored was built with NDEBUG #defined nothing bad will

happen, as assert() is doing nothing in this case. Note that the

default is not to define NDEBUG for xenstored builds even in release

builds of Xen.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00158 · 4.5th percentile
Weakness
CWE-617 · Reachable Assertion
Published
2026-05-19T18:16Z
Affected products (1)
ProductVersionsFixed in
xen/xen≥ 4.2.0—
References (3)
EPSS history
Timeline
  • 19 MAY 12:49Z
    Xenstored DoS via XS_RESET_WATCHES command
    cvelistv5