---
id: CVE-2026-23557
title: |-
  Any guest can cause xenstored to crash by issuing a XS_RESET_WATCHES
  command within a transaction due to an assert() triggering.

  In case xenstored was built with NDEBUG #defined nothing bad will
  happen, as assert() is doing nothing in t…
summary: |-
  Any guest can cause xenstored to crash by issuing a XS_RESET_WATCHES
  command within a transaction due to an assert() triggering.

  In case xenstored was built with NDEBUG #defined nothing bad will
  happen, as assert() is doing nothing in t…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H'
cwe:
  - CWE-617
vendor: xen
product: xen
affected:
  - xen >= 4.2.0
published: '2026-05-19'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T20:10:00.190'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-23557'
references:
  - url: 'https://xenbits.xenproject.org/xsa/advisory-484.html'
    label: security@xen.org
  - url: 'http://www.openwall.com/lists/oss-security/2026/04/28/11'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'http://xenbits.xen.org/xsa/advisory-484.html'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.00158
epssPercentile: 0.04449
ingestedAt: '2026-10-14T20:53:12.312Z'
---

## Overview

Any guest can cause xenstored to crash by issuing a XS_RESET_WATCHES
command within a transaction due to an assert() triggering.

In case xenstored was built with NDEBUG #defined nothing bad will
happen, as assert() is doing nothing in this case. Note that the
default is not to define NDEBUG for xenstored builds even in release
builds of Xen.

## Affected

- `xen >= 4.2.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.