Servers and applications
CVE-2016-9386
The x86 emulator in Xen does not properly treat x86 NULL segments as unusable when accessing memory, which might allow local HVM guest users to gain privileges via vectors involving "unexpected" base/limit values.
- Severity
- High 7.8
- Published
- 23 Jan 2017
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Exploit chance
- 0.4% in the next 30 daysHigher than 39% of CVEs. EPSS by FIRST, 11 Nov 2026
- Weakness
- CWE-264
- Attack
- Needs local access · Needs a user account · No user action needed
- Attacker can
- Read data · Change data · Take it down
- CVSS vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
XenServers and applications · cpe:o:xen:xen |
|