9.4

CVE-2025-58146: XAPI UTF-8 string handling

Deferred
AliasesALPINE-CVE-2025-58146
Published 09-07-2026Last modified 09-07-2026

Vulnerability summary

CVE-2025-58146 is a critical (CVSS 9.4) Improper Input Validation vulnerability in xen xapi. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 7.4% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 9.4 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 0% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
9.4/10
010
Critical · v4.0 (CVE.org)
EPSS score
0.18%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1
MGASA-2025-0270

Timeline

  1. 09-07-2026
    PublishedVulnerability first disclosed.
  2. 09-07-2026
    Last modifiedVulnerability information updated.

Description

There are multiple issues. 1. Updates to the XAPI database sanitise input strings, but try generating the notification using the unsanitised input. This causes the database's event thread to terminate and cease further processing. 2. XAPI's UTF-8 encoder implements v3.0 of the Unicode spec, but XAPI uses libraries which conform to the stricter v3.1 of the Unicode spec. This causes some strings to be accepted as valid UTF-8 by XAPI, but rejected by other libraries in use. Notably, such strings can be entered into the database, after which the database can no longer be loaded. 3. There is no input sanitisation for Map/Set updates on objects in the XAPI database.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.18%

Chance of exploitation in the next 30 days

Percentile

7%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.18% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: local access, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Alpine1 product
  • xenAll versions (No fix recorded)
Xen1 product

2 vendors · 2 products

References

4 links