Xen Flaws Let Guest VMs Read Other Memory
Xen Project disclosed two grant copy flaws, tracked as CVE-2026-102703 and CVE-2026-102704, that affect Xen 4.6 and later.
Updated on Nov. 4, 2026 in Cybersecurity
Xen Project disclosed two flaws that allow a malicious guest virtual machine to read and write the memory of other VMs. Patches have been released for Xen, XCP-ng 8.3, and Qubes OS 4.3.
Why it matters
The flaws sit in grant copy, the operation Xen uses to move data between VMs, so isolation between tenants on affected hosts is weakened. Xen's advisory does not mention any attacks exploiting them.
The flaws are tracked as CVE-2026-102703 and CVE-2026-102704 under advisory XSA-523 and affect all Xen versions from 4.6 onward, while 4.5 and earlier are unaffected. Xen reused previously completed permission checks for batched copies within the same memory page and in some cases did not recheck permissions when it should have.
The players
Xen Project
Xen Project is the open-source hypervisor project that maintains the Xen virtualization platform and issued the security advisory for these flaws.
Anthropic
Anthropic is an artificial intelligence company that develops the Claude models, which were credited with discovering the flaws.
The details
Xen Project credited Anthropic, using its Claude model, with finding the flaws, and Stephan Lipp of Ada Logics validated the finding. The CodeAnt AI Security Research Team independently reported the same issue; the flaws are separate from XSA-500, an earlier grant copy flaw disclosed July 28.
Timeline
Nov. 3: Xen Project issued the advisory and XCP-ng 8.3 released a patch.
Nov. 4: Debian's security tracker listed the xen package as vulnerable in several releases.
Within two weeks: Qubes OS fixed packages are expected to move from security-testing to the stable repository after community testing.
The Tech Race
XSA-523 is the second grant copy flaw Xen has disclosed this year, following XSA-500 on July 28, which points to recurring weaknesses in how the hypervisor shares memory between guests. The credit to an AI model for finding one of these flaws shows AI-assisted vulnerability discovery now reaching core virtualization code.
Operators running Xen 4.6 or later, XCP-ng 8.3, or Qubes OS 4.3 should apply the released patches, since the flaws let one guest VM reach memory belonging to others. Debian users should check whether their xen package is listed as vulnerable on the distribution's security tracker.
The takeaway
Keeping hypervisors patched matters most in multi-tenant environments, where one compromised guest could otherwise reach the memory of every other VM on the host.
What happens next
Qubes OS fixed packages are expected to move from security-testing to the stable repository within the next two weeks.
Further reading
Track more vulnerability disclosures in our Cybersecurity coverage.
