CVE-2016-7777

Xen 4.7.x and earlier does not properly honor CR0.TS and CR0.EM, which allows local x86 HVM guest OS users to read or modify FPU, MMX, or XMM register state information belonging to arbitrary tasks on the guest by modifying an instruction while the hypervisor is preparing to emulate it.

• CWE-362

• http://www.securityfocus.com/bid/93344Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1036942Third Party Advisory, VDB Entry
• http://xenbits.xen.org/xsa/advisory-190.htmlMitigation, Patch, Vendor Advisory
• https://security.gentoo.org/glsa/201611-09
• https://support.citrix.com/article/CTX217363
• http://www.securityfocus.com/bid/93344Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1036942Third Party Advisory, VDB Entry
• http://xenbits.xen.org/xsa/advisory-190.htmlMitigation, Patch, Vendor Advisory
• https://security.gentoo.org/glsa/201611-09
• https://support.citrix.com/article/CTX217363

Published

Oct 7, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-7770Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-7771Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-7772Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-7773Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-7774Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-7775Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-7780SQL injection vulnerability in cron/find_help.php in Exponen…
• CVE-2016-7781SQL injection vulnerability in framework/modules/blog/contro…
• CVE-2016-7782SQL injection vulnerability in framework/core/models/expConf…
• CVE-2016-7783SQL injection vulnerability in framework/core/models/expReco…
• CVE-2016-7784SQL injection vulnerability in the getSection function in fr…
• CVE-2016-7785The avi_read_seek function in libavformat/avidec.c in FFmpeg…