Cyber Resilience

CVE-2025-27466

Xen 4.13.0 – 4.17.0

Published
11 September 2025
Modified
04 November 2025
Patch / advisory
View advisory
CVSS Score v3.1 9.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0047 38th percentile
Risk Priority 71 floored blend · peak EPSS

Summary

CVE-2025-27466 is a critical-severity Use of NullPointerException Catch to Detect NULL Pointer Dereference (CWE-395) vulnerability in Xen Xen. Its CVSS base score is 9.8 (Critical).

Operationally, ranked at the 38th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and SA-15 (Development Process, Standards, and Tools) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are multiple issues related to the handling and accessing of guest memory pages in the viridian code: 1. A NULL pointer dereference…

more

in the updating of the reference TSC area. This is CVE-2025-27466. 2. A NULL pointer dereference by assuming the SIM page is mapped when a synthetic timer message has to be delivered. This is CVE-2025-58142. 3. A race in the mapping of the reference TSC page, where a guest can get Xen to free a page while still present in the guest physical to machine (p2m) page tables. This is CVE-2025-58143.

CWE(s)
CWE-395

Related Threats

CVEs Like This One

CVE-2025-58142Same product: Xen Xen
CVE-2024-45818Same product: Xen Xen
CVE-2023-46837Same product: Xen Xen
CVE-2024-45819Same product: Xen Xen
CVE-2025-58143Same product: Xen Xen
CVE-2023-34323Same product: Xen Xen
CVE-2023-34322Same product: Xen Xen
CVE-2025-58144Same product: Xen Xen
CVE-2024-31143Same product: Xen Xen
CVE-2025-58149Same product: Xen Xen

Affected Assets

xen
xen
4.13.0 — 4.17.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SA-11 Developer Testing and Evaluation good match

Developer testing and evaluation can discover catch blocks used for null detection during code review or dynamic analysis.

SA-15 Development Process, Standards, and Tools partial match

Documented development standards and tools can mandate explicit null checks instead of relying on exception handlers.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly enforce proper null handling via reviews and tooling rather than exception catching.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect improper exception handling but does not prevent the coding practice itself.

A.8.28 Secure coding partial match
prevents

Secure coding rules explicitly forbid catching NullPointerException to detect null dereferences.

References