CVE-2025-27465

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

Certain instructions need intercepting and emulating by Xen. In some cases Xen emulates the instruction by replaying it, using an executable stub. Some instructions may raise an exception, which is supposed to be handled gracefully. Certain replayed instructions have additional logic to set up and recover the changes to the arithmetic flags.

For replayed instructions where the flags recovery logic is used, the metadata for exception handling was incorrect, preventing Xen from handling the the exception gracefully, treating it as fatal instead.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-755

Affected software

No affected versions have been published.

Timeline

Published
Jul 16, 2025
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-274669.8[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are CVE-2025-274677.8Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally.CVE-2025-274687.0Improper privilege management in Windows Secure Kernel Mode allows an authorized attacker to elevate privileges locally.CVE-2025-274697.5Uncontrolled resource consumption in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service ovCVE-2025-27479.8An authentication bypass vulnerability in Kentico Xperience allows authentication bypass via the Staging Sync Server component password handCVE-2025-274707.5Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service overCVE-2025-274715.9Sensitive data storage in improperly locked memory in Microsoft Streaming Service allows an unauthorized attacker to deny service over a netCVE-2025-274725.4Protection mechanism failure in Windows Mark of the Web (MOTW) allows an unauthorized attacker to bypass a security feature over a network.CVE-2025-274737.5Uncontrolled resource consumption in Windows HTTP.sys allows an unauthorized attacker to deny service over a network.CVE-2025-274746.5Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information ovCVE-2025-274757.0Sensitive data storage in improperly locked memory in Windows Update Stack allows an authorized attacker to elevate privileges locally.CVE-2025-274767.8Use after free in Windows Digital Media allows an authorized attacker to elevate privileges locally.
CVE-2025-27465: Medium severity, CVSS 4.3 | Vulnix