CVE-2025-58144

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are two issues related to the mapping of pages belonging to other domains: For one, an assertion is wrong there, where the case actually needs handling. A NULL pointer de-reference could result on a release build. This is CVE-2025-58144. And then the P2M lock isn't held until a page reference was actually obtained (or the attempt to do so has failed). Otherwise the page can not only change type, but even ownership in between, thus allowing domain boundaries to be violated. This is CVE-2025-58145.

• CWE-476

• https://xenbits.xenproject.org/xsa/advisory-473.htmlVendor Advisory
• http://www.openwall.com/lists/oss-security/2025/09/09/2
• http://xenbits.xen.org/xsa/advisory-473.html

Published

Sep 11, 2025

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-58135Improper action enforcement in certain Zoom Workplace Client…6.5
• CVE-2025-58136A bug in POST request handling causes a crash under a certai…7.5
• CVE-2025-58137Authorization Bypass Through User-Controlled Key vulnerabili…8.1
• CVE-2025-5814The Profiler – What Slowing Down Your WP plugin for WordPres…5.3
• CVE-2025-58142[This CNA information record relates to multiple CVEs; the t…9.8
• CVE-2025-58143[This CNA information record relates to multiple CVEs; the t…9.8
• CVE-2025-58145[This CNA information record relates to multiple CVEs; the t…7.5
• CVE-2025-58146There are multiple issues. 1. Updates to the XAPI database…9.4
• CVE-2025-58147[This CNA information record relates to multiple CVEs; the t…7.5
• CVE-2025-58148[This CNA information record relates to multiple CVEs; the t…7.5
• CVE-2025-58149When passing through PCI devices, the detach logic in libxl …7.5
• CVE-2025-5815The Traffic Monitor plugin for WordPress is vulnerable to un…5.3