rainbutterfly/cve_corpus huggingface dataset:
CVE-2025-58094 
Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malicious URLs can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger these vulnerabilities.This vulnerability affects the worklistsrc parameter.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: MedDream
product: MedDream PACS Premium
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
Credits: lang: en
value: Discovered by Marcin &#39;Icewall&#39; Noga of Cisco Talos.
Published: 2026-01-20T14:49:37.849Z
CVE-2025-58095 
Multiple reflected cross-site scripting (xss) vulnerabilities exist in the config.php functionality of MedDream PACS Premium 7.3.6.870. Specially crafted malicious URLs can lead to arbitrary javascript code execution. An attacker can provide a crafted URL to trigger these vulnerabilities.This vulnerability affects the imagedir parameter.
Problem types: cwe_id: CWE-79
description: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected products: vendor: MedDream
product: MedDream PACS Premium
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
baseScore: 6.1
baseSeverity: MEDIUM
Credits: lang: en
value: Discovered by Marcin &#39;Icewall&#39; Noga of Cisco Talos.
Published: 2026-01-20T14:49:38.006Z
CVE-2025-58096 BIG-IP TMM vulnerability
When the database variable tm.tcpudptxchecksum is configured as non-default value Software-only on a BIG-IP system, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Problem types: cwe_id: CWE-787
description: CWE-787 Out-of-bounds Write
Affected products: vendor: F5
product: BIG-IP
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: F5
Published: 2025-10-15T13:55:52.333Z
CVE-2025-58097 
The installation directory of LogStare Collector is configured with incorrect access permissions. A non-administrative user may manipulate files within the installation directory and execute arbitrary code with the administrative privilege.
Problem types: cwe_id: CWE-276
description: Incorrect default permissions
Affected products: vendor: LogStare Inc.
product: LogStare Collector (for Windows)
vendor: LogStare Inc.
product: LogStare Collector (for Linux)
Published: 2025-11-21T06:17:50.799Z
CVE-2025-58098 Apache HTTP Server: Server Side Includes adds query string to #exec cmd=...
Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives.

This issue affects Apache HTTP Server before 2.4.66.

Users are recommended to upgrade to version 2.4.66, which fixes the issue.
Problem types: cwe_id: CWE-201
description: CWE-201 Insertion of Sensitive Information Into Sent Data
Affected products: vendor: Apache Software Foundation
product: Apache HTTP Server
default_status: unaffected
Credits: lang: en
value: Anthony Parfenov (United Rentals, Inc.)
Published: 2025-12-05T13:40:39.772Z
CVE-2025-58107 
In Microsoft Exchange through 2019, Exchange ActiveSync (EAS) configurations on on-premises servers may transmit sensitive data from Samsung mobile devices in cleartext, including the user's name, e-mail address, device ID, bearer token, and base64-encoded password.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-02T00:00:00.000Z
CVE-2025-58112 
Microsoft Dynamics 365 Customer Engagement (on-premises) 1612 (9.0.2.3034) allows the generation of customized reports via raw SQL queries in an upload of a .rdl (Report Definition Language) file; this is then processed by the SQL Server Reporting Service. An account with the privilege Add Reporting Services Reports can upload a malicious rdl file. If the malicious rdl file is already loaded and it is executable by the user, the Add Reporting Services Reports privilege is not required. A malicious actor can trigger the generation of the report, causing the execution of arbitrary SQL commands in the underlying database. Depending on the permissions of the account running SQL Server Reporting Services, the attacker may be able to perform additional actions, such as accessing linked servers or executing operating system commands.
Problem types: description: n/a
Affected products: vendor: n/a
product: n/a
Published: 2026-03-18T00:00:00.000Z
CVE-2025-58113 
An out-of-bounds read vulnerability exists in the EMF functionality of PDF-XChange Co. Ltd PDF-XChange Editor 10.7.3.401.  By using a specially crafted EMF file, an attacker could exploit this vulnerability to perform an out-of-bounds read, potentially leading to the disclosure of sensitive information.
Problem types: cwe_id: CWE-125
description: CWE-125: Out-of-bounds Read
Affected products: vendor: PDF-XChange Co. Ltd
product: PDF-XChange Editor
CVSS v3.1: version: 3.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
Credits: lang: en
value: Discovered by KPC of Cisco Talos.
Published: 2025-12-02T15:32:20.095Z
CVE-2025-58114 Potential XSS in Extension:CognitiveProcessDesigner
Improper Input Validation vulnerability in Hallo Welt! GmbH BlueSpice (Extension:CognitiveProcessDesigner) allows Cross-Site Scripting (XSS).This issue affects BlueSpice: from 5 through 5.1.1.
Problem types: cwe_id: CWE-20
description: CWE-20 Improper Input Validation
Affected products: vendor: Hallo Welt! GmbH
product: BlueSpice
default_status: affected
Published: 2025-09-19T13:10:38.231Z
CVE-2025-58115 
ChatLuck contains a cross-site scripting vulnerability in Guest User Sign-up. If exploited, an arbitrary script may be executed on the web browser of the user who is accessing the product.
Problem types: cwe_id: CWE-79
description: Cross-site scripting (XSS)
Affected products: vendor: NEOJAPAN Inc.
product: ChatLuck
Published: 2025-10-16T08:55:14.283Z
CVE-2025-58116 
Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in WN-7D36QR and WN-7D36QR/UE. If this vulnerability is exploited, an arbitrary OS command may be executed by a remote authenticated attacker.
Problem types: cwe_id: CWE-78
description: Improper neutralization of special elements used in an OS command ('OS Command Injection')
Affected products: vendor: I-O DATA DEVICE, INC.
product: WN-7D36QR
vendor: I-O DATA DEVICE, INC.
product: WN-7D36QR/UE
CVSS v3.1: version: 3.1
baseSeverity: HIGH
baseScore: 7.2
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Published: 2025-09-17T03:08:40.791Z
CVE-2025-58120 BIG-IP Next (CNF, SPK, and Kubernetes) vulnerability
When HTTP/2 Ingress is configured, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate.  Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Problem types: cwe_id: CWE-476
description: CWE-476 NULL Pointer Dereference
Affected products: vendor: F5
product: BIG-IP Next SPK
default_status: unknown
vendor: F5
product: BIG-IP Next CNF
default_status: unknown
vendor: F5
product: BIG-IP Next for Kubernetes
default_status: unknown
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 7.5
baseSeverity: HIGH
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
version: 3.1
Credits: lang: en
value: F5
Published: 2025-10-15T13:55:51.117Z
CVE-2025-58121 Insufficient permission validation on multiple REST API endpoints
Insufficient permission validation on multiple REST API endpoints in Checkmk 2.2.0, 2.3.0, and 2.4.0 before version 2.4.0p16 allows low-privileged users to perform unauthorized actions or obtain sensitive information
Problem types: cwe_id: CWE-280
description: CWE-280: Improper Handling of Insufficient Permissions or Privileges
Affected products: vendor: Checkmk GmbH
product: Checkmk
default_status: unaffected
Credits: lang: en
value: PS Positive Security GmbH
Published: 2025-11-18T15:11:35.167Z
CVE-2025-58122 Insufficient permission validation when configuring notification parameters
Insufficient permission validation in Checkmk 2.4.0 before version 2.4.0p16 allows low-privileged users to modify notification parameters via the REST API, which could lead to unauthorized actions or information disclosure.
Problem types: cwe_id: CWE-280
description: CWE-280: Improper Handling of Insufficient Permissions or Privileges
Affected products: vendor: Checkmk GmbH
product: Checkmk
default_status: unaffected
Credits: lang: en
value: PS Positive Security GmbH
Published: 2025-11-18T15:11:17.244Z
CVE-2025-58123 Lack of TLS validation in plugin BGP Monitoring on Checkmk Exchange
Improper Certificate Validation in Checkmk Exchange plugin BGP Monitoring allows attackers in MitM position to intercept traffic.
Problem types: cwe_id: CWE-295
description: CWE-295 Improper Certificate Validation
Affected products: default_status: affected
Credits: lang: en
value: Felix Eberstaller (Limes Security)
lang: en
value: Jakob Hartmann (Limes Security)
Published: 2025-08-28T12:59:25.737Z
CVE-2025-58124 Lack of TLS validation in plugin check-mk-api on Checkmk Exchange
Improper Certificate Validation in Checkmk Exchange plugin check-mk-api allows attackers in MitM position to intercept traffic.
Problem types: cwe_id: CWE-295
description: CWE-295 Improper Certificate Validation
Affected products: default_status: unaffected
Credits: lang: en
value: Felix Eberstaller (Limes Security)
lang: en
value: Jakob Hartmann (Limes Security)
Published: 2025-08-28T12:59:28.526Z
CVE-2025-58125 Lack of TLS validation in plugin Freebox v6 agent on Checkmk Exchange
Improper Certificate Validation in Checkmk Exchange plugin Freebox v6 agent allows attackers in MitM position to intercept traffic.
Problem types: cwe_id: CWE-295
description: CWE-295 Improper Certificate Validation
Affected products: default_status: affected
Credits: lang: en
value: Felix Eberstaller (Limes Security)
lang: en
value: Jakob Hartmann (Limes Security)
Published: 2025-08-28T12:59:31.212Z
CVE-2025-58126 Lack of TLS validation in plugin VMware vSAN on Checkmk Exchange
Improper Certificate Validation in Checkmk Exchange plugin VMware vSAN allows attackers in MitM position to intercept traffic.
Problem types: cwe_id: CWE-295
description: CWE-295 Improper Certificate Validation
Affected products: default_status: affected
Credits: lang: en
value: Felix Eberstaller (Limes Security)
lang: en
value: Jakob Hartmann (Limes Security)
Published: 2025-08-28T12:59:33.842Z
CVE-2025-58127 Lack of TLS validation in plugin Dell Powerscale on Checkmk Exchange
Improper Certificate Validation in Checkmk Exchange plugin Dell Powerscale allows attackers in MitM position to intercept traffic.
Problem types: cwe_id: CWE-295
description: CWE-295 Improper Certificate Validation
Affected products: default_status: affected
Credits: lang: en
value: Felix Eberstaller (Limes Security)
lang: en
value: Jakob Hartmann (Limes Security)
Published: 2025-08-28T12:59:36.596Z
CVE-2025-58130 Apache Fineract: Server Key not masked
Insufficiently Protected Credentials vulnerability in Apache Fineract.

This issue affects Apache Fineract: through 1.11.0. The issue is fixed in version 1.12.1.

Users are encouraged to upgrade to version 1.13.0, the latest release.
Problem types: cwe_id: CWE-522
description: CWE-522 Insufficiently Protected Credentials
Affected products: vendor: Apache Software Foundation
product: Apache Fineract
default_status: unaffected
Credits: lang: en
value: Peter Chen
lang: en
value: Jose Alberto Hernandez
lang: en
value: Ádám Sághy
Published: 2025-12-12T09:20:06.930Z
CVE-2025-58131 Zoom Workplace VDI Plugin macOS Universal installer for VMware Horizon - Race Condition
Race condition in the Zoom Workplace VDI Plugin macOS Universal installer for VMware Horizon before version 6.4.10 (or before 6.2.15 and 6.3.12 in their respective tracks) may allow an authenticated user to conduct a disclosure of information via network access.
Problem types: cwe_id: CWE-367
description: CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
Affected products: vendor: Zoom Communications, Inc
product: Zoom Workplace VDI Plugin macOS Universal installer for VMware Horizon
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: NONE
baseScore: 6.6
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
version: 3.1
Published: 2025-09-09T21:48:51.081Z
CVE-2025-58132 Zoom Clients for Windows - Command Injection
Command injection in some Zoom Clients for Windows may allow an authenticated user to conduct a disclosure of information via network access.
Problem types: cwe_id: CWE-77
description: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
Affected products: vendor: Zoom Communications Inc.
product: Zoom Clients for Windows
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.1
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: LOW
scope: CHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
version: 3.1
Published: 2025-10-15T16:10:20.442Z
CVE-2025-58133 Zoom Rooms Clients - Authentication Bypass
Authentication bypass in some Zoom Rooms Clients before version 6.5.1 may allow an unauthenticated user to conduct a disclosure of information via network access.
Problem types: cwe_id: CWE-288
description: CWE-288: Authentication Bypass Using an Alternate Path or Channel
Affected products: vendor: Zoom Communications Inc.
product: Zoom Rooms
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Published: 2025-10-15T16:13:28.273Z
CVE-2025-58134 Zoom Workplace Clients for Windows - Incorrect Authorization
Incorrect authorization in certain Zoom Workplace Clients for Windows may allow an authenticated user to conduct an impact to integrity via network access.
Problem types: cwe_id: CWE-863
description: CWE-863 Incorrect Authorization
Affected products: vendor: Zoom Communications, Inc
product: Zoom Workplace Clients for Windows
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.3
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: LOW
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
version: 3.1
Published: 2025-09-09T21:44:01.928Z
CVE-2025-58135 Zoom Workplace Clients for Windows - Improper Action Enforcement
Improper action enforcement in certain Zoom Workplace Clients for Windows may allow an unauthenticated user to conduct a disclosure of information via network access.
Problem types: cwe_id: CWE-837
description: CWE-837: Improper Enforcement of a Single, Unique Action
Affected products: vendor: Zoom Communications, Inc
product: Zoom Workplace Clients for Windows
default_status: unaffected
CVSS v3.1: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: REQUIRED
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
version: 3.1
Published: 2025-09-09T21:45:52.362Z
CVE-2025-58136 Apache Traffic Server: A simple legitimate POST request causes a crash
A bug in POST request handling causes a crash under a certain condition.

This issue affects Apache Traffic Server: from 10.0.0 through 10.1.1, from 9.0.0 through 9.2.12.

Users are recommended to upgrade to version 10.1.2 or 9.2.13, which fix the issue.

A workaround for older versions is to set proxy.config.http.request_buffer_enabled to 0 (the default value is 0).
Problem types: cwe_id: CWE-670
description: CWE-670 Always-Incorrect Control Flow Implementation
Affected products: vendor: Apache Software Foundation
product: Apache Traffic Server
default_status: unaffected
Published: 2026-04-02T15:54:47.013Z
CVE-2025-58137 Apache Fineract: IDOR via self-service API
Authorization Bypass Through User-Controlled Key vulnerability in Apache Fineract.

This issue affects Apache Fineract: through 1.11.0. The issue is fixed in version 1.12.1.

Users are encouraged to upgrade to version 1.13.0, the latest release.
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: Apache Software Foundation
product: Apache Fineract
default_status: unaffected
Credits: lang: en
value: Peter Chen
lang: en
value: Ádám Sághy
lang: en
value: Aleksandar Vidakovic
lang: en
value: Víctor Romero
Published: 2025-12-12T09:21:00.374Z
CVE-2025-58142 Mutiple vulnerabilities in the Viridian interface
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]

There are multiple issues related to the handling and accessing of guest
memory pages in the viridian code:

 1. A NULL pointer dereference in the updating of the reference TSC area.
    This is CVE-2025-27466.

 2. A NULL pointer dereference by assuming the SIM page is mapped when
    a synthetic timer message has to be delivered.  This is
    CVE-2025-58142.

 3. A race in the mapping of the reference TSC page, where a guest can
    get Xen to free a page while still present in the guest physical to
    machine (p2m) page tables.  This is CVE-2025-58143.
Affected products: vendor: Xen
product: Xen
default_status: unknown
Credits: lang: en
value: This issue was discovered by Roger Pau Monné of XenServer.
Published: 2025-09-11T14:05:29.649Z
CVE-2025-58143 Mutiple vulnerabilities in the Viridian interface
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]

There are multiple issues related to the handling and accessing of guest
memory pages in the viridian code:

 1. A NULL pointer dereference in the updating of the reference TSC area.
    This is CVE-2025-27466.

 2. A NULL pointer dereference by assuming the SIM page is mapped when
    a synthetic timer message has to be delivered.  This is
    CVE-2025-58142.

 3. A race in the mapping of the reference TSC page, where a guest can
    get Xen to free a page while still present in the guest physical to
    machine (p2m) page tables.  This is CVE-2025-58143.
Affected products: vendor: Xen
product: Xen
default_status: unknown
Credits: lang: en
value: This issue was discovered by Roger Pau Monné of XenServer.
Published: 2025-09-11T14:05:29.729Z
CVE-2025-58144 Arm issues with page refcounting
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]

There are two issues related to the mapping of pages belonging to other
domains: For one, an assertion is wrong there, where the case actually
needs handling.  A NULL pointer de-reference could result on a release
build.  This is CVE-2025-58144.

And then the P2M lock isn't held until a page reference was actually
obtained (or the attempt to do so has failed).  Otherwise the page can
not only change type, but even ownership in between, thus allowing
domain boundaries to be violated.  This is CVE-2025-58145.
Affected products: vendor: Xen
product: Xen
default_status: unknown
Credits: lang: en
value: This issue was discovered by Jan Beulich of SUSE.
Published: 2025-09-11T14:05:36.284Z
CVE-2025-58145 Arm issues with page refcounting
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]

There are two issues related to the mapping of pages belonging to other
domains: For one, an assertion is wrong there, where the case actually
needs handling.  A NULL pointer de-reference could result on a release
build.  This is CVE-2025-58144.

And then the P2M lock isn't held until a page reference was actually
obtained (or the attempt to do so has failed).  Otherwise the page can
not only change type, but even ownership in between, thus allowing
domain boundaries to be violated.  This is CVE-2025-58145.
Affected products: vendor: Xen
product: Xen
default_status: unknown
Credits: lang: en
value: This issue was discovered by Jan Beulich of SUSE.
Published: 2025-09-11T14:05:36.380Z
CVE-2025-58147 x86: Incorrect input sanitisation in Viridian hypercalls
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]

Some Viridian hypercalls can specify a mask of vCPU IDs as an input, in
one of three formats.  Xen has boundary checking bugs with all three
formats, which can cause out-of-bounds reads and writes while processing
the inputs.

 * CVE-2025-58147.  Hypercalls using the HV_VP_SET Sparse format can
   cause vpmask_set() to write out of bounds when converting the bitmap
   to Xen's format.

 * CVE-2025-58148.  Hypercalls using any input format can cause
   send_ipi() to read d->vcpu[] out-of-bounds, and operate on a wild
   vCPU pointer.
Affected products: vendor: Xen
product: Xen
default_status: unknown
Credits: lang: en
value: This issue was discovered by Teddy Astie of Vates
Published: 2025-10-31T11:50:28.282Z
CVE-2025-58148 x86: Incorrect input sanitisation in Viridian hypercalls
[This CNA information record relates to multiple CVEs; the
text explains which aspects/vulnerabilities correspond to which CVE.]

Some Viridian hypercalls can specify a mask of vCPU IDs as an input, in
one of three formats.  Xen has boundary checking bugs with all three
formats, which can cause out-of-bounds reads and writes while processing
the inputs.

 * CVE-2025-58147.  Hypercalls using the HV_VP_SET Sparse format can
   cause vpmask_set() to write out of bounds when converting the bitmap
   to Xen's format.

 * CVE-2025-58148.  Hypercalls using any input format can cause
   send_ipi() to read d->vcpu[] out-of-bounds, and operate on a wild
   vCPU pointer.
Affected products: vendor: Xen
product: Xen
default_status: unknown
Credits: lang: en
value: This issue was discovered by Teddy Astie of Vates
Published: 2025-10-31T11:50:28.407Z