Critical severity · published Jul 9, 2026
CVE-2025-58146
XAPI UTF-8 string handling
9.4
CVSS
0.2%
EPSS
No
On KEV
Description
There are multiple issues.
1. Updates to the XAPI database sanitise input strings, but try
generating the notification using the unsanitised input. This
causes the database's event thread to terminate and cease further
processing.
2. XAPI's UTF-8 encoder implements v3.0 of the Unicode spec, but XAPI
uses libraries which conform to the stricter v3.1 of the Unicode
spec. This causes some strings to be accepted as valid UTF-8 by
XAPI, but rejected by other libraries in use. Notably, such strings
can be entered into the database, after which the database can no
longer be loaded.
3. There is no input sanitisation for Map/Set updates on objects in the
XAPI database.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
XA
XAPI · Xen
All versions, or not specified · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-58146
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-58146
xenbits.xen.org
https://xenbits.xen.org/xsa/advisory-474.html
www.openwall.com
http://www.openwall.com/lists/oss-security/2025/09/09/3
xenbits.xen.org
http://xenbits.xen.org/xsa/advisory-474.html
More from XAPI
9.4
CVE-2026-42486
Multiple RBAC issues in XAPI
9.4
CVE-2026-23562
Multiple RBAC issues in XAPI
9.4
CVE-2026-23561
Multiple RBAC issues in XAPI
9.4
CVE-2026-23560
Multiple RBAC issues in XAPI
9.4
CVE-2026-23559
Multiple RBAC issues in XAPI
