A flaw in the Xen hypervisor lets a single compromised virtual machine break out of its isolation and reach the memory of every other guest on the same host, including the privileged control domain. The Xen Project published the advisory, XSA-523, on 3 November 2026, covering two related flaws tracked as CVE-2026-102703 and CVE-2026-102704.

The bug lies in grant copy, the mechanism virtual machines use to share memory with each other. In batched copy operations, Xen reused cached validation data in cases where it should have re-checked it, so a guest could get the hypervisor to copy data to or from memory it did not own. The project's own impact statement is blunt: a malicious guest can read and write arbitrary memory belonging to other domains, including Dom0, the control domain that manages all the others.

Every Xen version from 4.6 onward is affected, and the project says there is no known mitigation. The only fix is a patched hypervisor followed by a host reboot. Patches cover Xen 4.17 and later; no upstream patch exists for versions 4.6 to 4.16, whose security support has already ended. Fixed releases are available for XCP-ng 8.3, Citrix XenServer 8.4 and 9, Qubes OS 4.3 and SUSE Linux Enterprise 15 SP7, while Debian's stable releases were still listed as vulnerable on 4 November.

The flaws were discovered by Anthropic using its Claude model and validated by researcher Stephan Lipp of Ada Logics, with the CodeAnt AI security team reporting them independently. No attacks using the flaws have been reported, and no indicators of compromise have been published. Organisations that rent virtual servers should ask their providers whether they run Xen, which version, and when patched hosts will be rebooted, since a patched package protects nothing until the host restarts.