# Xen XSA-523: malicious guest can read and write any VM's memory, including dom0, via grant copy (CVE-2026-102703, CVE-2026-102704) · pwn.watch > Two flaws in the Xen hypervisor's grant copy operation let a malicious guest VM read and write arbitrary memory belonging to other domains, including dom0, breaking VM isolation on the host. Xen caches already-validated data during batches of grant copies on the same page, but re-validated it incorrectly: frame numbers and grant references could be mixed up (CVE-2026-102703), and the check limiting copy-by-frame-number to the caller's own memory was misplaced (CVE-2026-102704). Every Xen version from 4.6 onward is vulnerable and there is no mitigation. The Xen Project published patches for xen-unstable through 4.17.x on Nov 3 2026; XCP-ng 8.3 and Qubes OS 4.3 shipped fixed packages that need a host or dom0 reboot, while Debian stable releases were still listed as vulnerable on Nov 4. Found by Anthropic using Claude and validated by Ada Logics; no exploitation has been reported. Page: https://pwn.watch/i/xen-xsa-523-grant-copy-guest-escape-cve-2026-102703 · generated 2026-11-04T15:19:03.586Z ## Status - Severity: critical · status: live · patch: partial - Product: Xen hypervisor (and XCP-ng, Qubes OS and other Xen-based platforms) - Started: 2026-11-03 - CVEs: CVE-2026-102703, CVE-2026-102704 - Affected: Xen 4.6 and later (4.5 and earlier are not vulnerable); Xen 4.6 to 4.16: no upstream patch (out of security support); Downstream Xen packages until they include the XSA-523 patches (Debian bookworm, trixie and forky listed vulnerable on Nov 4) - Fixed in: Xen xen-unstable to 4.19.x: xsa523-1/2 patches; Xen 4.18.x to 4.17.x: xsa523-4.18-1/2 patches; XCP-ng 8.3: xen-4.17.7-4.2.xcpng8.3 (reboot required); Qubes OS 4.3: Xen 4.19.6-3 in dom0 (security-testing first; restart required) ## Follow this incident - RSS (one item per update): https://pwn.watch/i/xen-xsa-523-grant-copy-guest-escape-cve-2026-102703/feed.xml - JSON Feed: https://pwn.watch/i/xen-xsa-523-grant-copy-guest-escape-cve-2026-102703/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/xen-xsa-523-grant-copy-guest-escape-cve-2026-102703.json - This file: https://pwn.watch/i/xen-xsa-523-grant-copy-guest-escape-cve-2026-102703/llms.txt ## Updates (newest first) - 2026-11-03: Xen Project publishes XSA-523 (CVE-2026-102703, CVE-2026-102704) with patches for xen-unstable through Xen 4.17.x; no known mitigation. (https://xenbits.xen.org/xsa/advisory-523.html) - 2026-11-03: XCP-ng releases xen-4.17.7-4.2.xcpng8.3 and Qubes OS publishes fixed Xen 4.19.6-3 packages for Qubes 4.3; both require a host or dom0 reboot. (https://thehackernews.com/2026/11/xen-hypervisor-flaws-let-one-malicious.html) ## Fix brief # Security brief: Xen XSA-523: malicious guest can read and write any VM's memory, including dom0, via grant copy (CVE-2026-102703, CVE-2026-102704) Source: https://pwn.watch/i/xen-xsa-523-grant-copy-guest-escape-cve-2026-102703 · status: live · severity: critical · updated Nov 4, 2026, 13:57 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is Two flaws in the Xen hypervisor's grant copy operation let a malicious guest VM read and write arbitrary memory belonging to other domains, including dom0, breaking VM isolation on the host. Xen caches already-validated data during batches of grant copies on the same page, but re-validated it incorrectly: frame numbers and grant references could be mixed up (CVE-2026-102703), and the check limiting copy-by-frame-number to the caller's own memory was misplaced (CVE-2026-102704). Every Xen version from 4.6 onward is vulnerable and there is no mitigation. The Xen Project published patches for xen-unstable through 4.17.x on Nov 3 2026; XCP-ng 8.3 and Qubes OS 4.3 shipped fixed packages that need a host or dom0 reboot, while Debian stable releases were still listed as vulnerable on Nov 4. Found by Anthropic using Claude and validated by Ada Logics; no exploitation has been reported. Severity detail: Guest-to-host and cross-VM memory read/write with no mitigation; XCP-ng's vendor Vates rates it Critical; no known exploitation - Product: Xen hypervisor (and XCP-ng, Qubes OS and other Xen-based platforms) - CVE / advisory ids: CVE-2026-102703, CVE-2026-102704 ## Affected versions - Xen 4.6 and later (4.5 and earlier are not vulnerable) - Xen 4.6 to 4.16: no upstream patch (out of security support) - Downstream Xen packages until they include the XSA-523 patches (Debian bookworm, trixie and forky listed vulnerable on Nov 4) ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - Xen xen-unstable to 4.19.x: xsa523-1/2 patches - Xen 4.18.x to 4.17.x: xsa523-4.18-1/2 patches - XCP-ng 8.3: xen-4.17.7-4.2.xcpng8.3 (reboot required) - Qubes OS 4.3: Xen 4.19.6-3 in dom0 (security-testing first; restart required) After upgrading, re-run the checks above and redeploy/restart the affected services. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Specific notes If you run Xen hosts with untrusted guests: apply the XSA-523 patches or your vendor's fixed Xen package and reboot the host. XCP-ng 8.3 users install xen-4.17.7-4.2.xcpng8.3; Qubes 4.3 users install dom0 updates (Xen 4.19.6-3) and restart, and Anti Evil Maid users reseal. Xen 4.6 to 4.16 have no patch: upgrade. ## Latest updates - Nov 3, 2026: Xen Project publishes XSA-523 (CVE-2026-102703, CVE-2026-102704) with patches for xen-unstable through Xen 4.17.x; no known mitigation. - Nov 3, 2026: XCP-ng releases xen-4.17.7-4.2.xcpng8.3 and Qubes OS publishes fixed Xen 4.19.6-3 packages for Qubes 4.3; both require a host or dom0 reboot. ## Advisories - [XSA-523: arbitrary read/write via grant copy](https://xenbits.xen.org/xsa/advisory-523.html) (Xen Project) ## Write-ups & news - [Xen Hypervisor Flaws Let One Malicious VM Read and Write Any Other VM's Memory](https://thehackernews.com/2026/11/xen-hypervisor-flaws-let-one-malicious.html) --- Machine-readable: https://pwn.watch/i/xen-xsa-523-grant-copy-guest-escape-cve-2026-102703.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.