On November 3 the Xen Project published advisory XSA-523 on two flaws, CVE-2026-102703 and CVE-2026-102704, in grant copy, the mechanism that copies data between virtual machines. According to the advisory, a malicious virtual machine can read and write the memory of other machines on the same host, including dom0, the fully privileged machine that manages the rest. All versions from 4.6 onward are vulnerable; 4.5 and earlier are not.
The cause, as explained: to save time on a batch of copies within the same memory page, Xen reused permission checks it had already made, and in some cases did not check again when it should have. The Xen Project credited Anthropic with finding the flaws using its Claude model. A researcher at Ada Logics validated the finding, and a CodeAnt AI team reported it independently.
What to do: patches are available and there is no other mitigation, so anyone running Xen hosts should apply them. Products built on Xen remain vulnerable until their makers ship the fix: XCP-ng wrote that a single compromised guest can take over the whole host, Qubes OS said all its supported releases are affected, and as of November 4 Debian still listed its xen package as vulnerable in most releases.
The advisory does not mention any exploitation and does not specify what access inside the virtual machine an attacker needs.