CVE-2018-19962: Citrix Xenserver

High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days.

An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because small IOMMU mappings are unsafely combined into larger ones.

Affected products

• Citrix Xenserver: version 7.0 only; version 7.1 only; version 7.5 only; version 7.6 only
• Debian Debian Linux: version 9.0 only
• Xen Xen: up to and including 4.11.1

Published 2018-12-08. Last modified 2026-06-17.