CVE Tools
Sign in

CVE-2025-58143

Mutiple vulnerabilities in the Viridian interface

Published: Sep 11, 2025Updated: Nov 4, 2025 Sources: CVE List NVD BDUCWE-366
NVD MITRE
9.8CVSSCRITICAL
EPSS Score
0.3%
Top 74.0%
CISA KEV
Not in KEV
Exploits
No Known Exploits
Remediation
Patch Available

Description

[This CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabilities correspond to which CVE.] There are multiple issues related to the handling and accessing of guest memory pages in the viridian code: 1. A NULL pointer dereference in the updating of the reference TSC area. This is CVE-2025-27466. 2. A NULL pointer dereference by assuming the SIM page is mapped when a synthetic timer message has to be delivered. This is CVE-2025-58142. 3. A race in the mapping of the reference TSC page, where a guest can get Xen to free a page while still present in the guest physical to machine (p2m) page tables. This is CVE-2025-58143.

CVSS Vector Breakdown

AV:NAC:LPR:NUI:NS:UC:HI:HA:H
Exploitability
AV:NAttack Vector
Network
AC:LAttack Complexity
Low
PR:NPrivileges Required
None
UI:NUser Interaction
None
Scope
S:UScope
Unchanged
Impact
C:HConfidentiality
High
I:HIntegrity
High
A:HAvailability
High
Open in CVSS calculator →

Weaknesses

CWE-366

Affected Products

РЕД ОСООО «Ред Софт»
On-premOS
Operating Systems / linux-distro
XenThe Linux Foundation
On-prem
Cloud & SaaS / virtualization
ОСОН ОСнова ОnyxАО «НППКТ»
On-premOS
Operating Systems / linux-distro
XenXen
On-prem
Cloud & SaaS / virtualization
xenxen
On-prem
Cloud & SaaS / virtualization
ооо «ред софт»commercialRUOperating Systemsaka red soft
the linux foundationoss-projectUSCloud & SaaSaka linuxfoundation.org, linux foundation
ао «нппкт»commercialRUOperating Systems
xenoss-projectGBCloud & SaaSaka xapi, qemu

Exploitability

Official Patch Available
Workaround Available

References

https://redos.red-soft.ru/support/secure/
redos.red-soft.ru
https://xenbits.xenproject.org/xsa/advisory-472.html
xenbits.xenproject.org
https://поддержка.нппкт.рф/bin/view/ОСнова/Обновления/3.1/
xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai
and 2 more references View all →

Timeline

Published
Sep 11, 2025
Last Updated
Nov 4, 2025

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2025-58143 and every CVE in our database. Create a free account — no credit card required.

Create Free Account
Plain-language analysis
Impact assessment and exploitation scenario in plain English
Attack graph visualization
Interactive attack path and kill chain mapping
Exploit details & PoC links
ExploitDB, Metasploit, GitHub PoCs with direct links
Nuclei scanner templates
Ready-to-use vulnerability scanner templates
Full remediation guide
Patch instructions, workarounds, and compliance impact
Interactive AI chat
Ask questions about this vulnerability in natural language
Related vulnerabilities
Semantically similar CVEs and attack patterns
REST API & MCP access
Integrate vulnerability data into your workflows