The Xen Windows PV drivers expose several facilities to userspace without proper security descriptors, resulting in incorrect default permissions. Specifically, the XenIface component (CVE-2025-27463) is fully accessible to unprivileged users due to missing security descriptors. This vulnerability is categorized under CWE-276 (Incorrect Default Permissions). The CVSS 4.0 vector indicates local attack vector with low complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, availability, and security requirements. No vendor advisory or patch information is currently available.

Unprivileged users can access the XenIface facility without restriction, potentially leading to unauthorized actions or information disclosure within the Xen Windows PV driver environment. The vulnerability affects confidentiality, integrity, availability, and security controls at a high level, as reflected by the CVSS score of 9.4. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to affected systems and consider applying any available workarounds or configuration changes recommended by the vendor once available.