CVE-2018-19961: Citrix Xenserver

High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days.

An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because TLB flushes do not always occur after IOMMU mapping changes.

Affected products

• Citrix Xenserver: version 7.0 only; version 7.1 only; version 7.5 only; version 7.6 only
• Debian Debian Linux: version 9.0 only
• Xen Xen: up to and including 4.11.1

Published 2018-12-08. Last modified 2026-06-17.