The Xen Project fixed two flaws in Xen’s software for running virtual machines, disclosed on November 3 and found with help from Anthropic’s Claude; the flaws could let a malicious virtual machine read and change other virtual machines’ memory, including memory in the host’s privileged management domain.
The flaws, listed as CVE-2026-102703 and CVE-2026-102704 in advisory XSA-523, affect Xen’s “grant copy” operation, which transfers data between virtual machines. Xen says the flaws came from mistakes in how its software reused memory-access checks or applied them during groups of copy operations. A virtual machine that exploited the flaws could access memory belonging to other virtual machines on the same host, potentially breaking the separation between them.
The advisory says all Xen versions from 4.6 onward are vulnerable, while versions 4.5 and earlier are not. It also says there is no known way to work around the flaws, so operators should apply available fixes. Xen credited Claude with finding the flaws.
It credited Stephan Lipp of Ada Logics with validating them. It credited the CodeAnt AI Security Research Team with independently reporting the same issue. Xen’s advisory does not report any confirmed attacks exploiting the flaws.