CVE-2026-62429 is a synchronization vulnerability where the vNUMA configuration data of a guest VM remains accessible while the domain destruction process is underway. The cleanup of this data is not synchronized with its retrieval by the device model, allowing access to configuration information that should be in the process of being destroyed. The vulnerability is categorized under CWE-362 (Race Condition). The CVSS 3.1 vector indicates network attack vector, low attack complexity, requires low privileges, no user interaction, unchanged scope, high confidentiality impact, no integrity or availability impact.

An attacker with low privileges and network access could access sensitive vNUMA configuration data of a guest VM during its destruction phase. This could lead to confidentiality breaches but does not affect integrity or availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, monitor vendor advisories for updates. No specific mitigations are indicated in the current information.