The Xen Project Security Team published XSA-523 on 3 November 2026. Xen says that, for performance reasons, it caches details internally when handling batches of Grant Copy operations, and the conditions for re-validating that data were not correct in some cases: frame numbers and grant references could wrongly be mixed up (CVE-2026-102703), and the check that limits copying by frame number to the caller's own memory was misplaced (CVE-2026-102704).

Xen says a malicious guest can read and write arbitrary memory belonging to other domains, including Dom0, that all Xen versions from 4.6 onwards are vulnerable (4.5 and earlier are not), and that there is no known mitigation.

Xen says applying the attached patches resolves the issue (xsa523 patches for xen-unstable to Xen 4.19.x, and xsa523-4.18 patches for Xen 4.18.x to 4.17.x). Xen credits Anthropic, using Claude, with discovering the issue, validated by Stephan Lipp of Ada Logics, and says it was then independently reported by the CodeAnt AI Security Research Team.

Xen's advisory gives no CVSS score. (source: Xen Project) In its 4 November write-up, which it calls Xenbleed, CodeAnt AI says it built a working guest-to-Dom0 escape on XenServer 9.0.0 running Xen 4.21.2-3, demonstrating reads and writes of Dom0 memory and running instructions in the Dom0 Linux kernel, that its chain exercises CVE-2026-102704 (it did not independently exercise CVE-2026-102703), and that the attacker needs kernel-level control inside a guest.

CodeAnt AI gives its own CVSS assessment of 9.3 Critical (v3.1) and 9.4 Critical (v4.0) and advises operators running untrusted or tenant-controlled guests to deploy a hypervisor or downstream update that includes both fixes. (source: CodeAnt AI)