Buffer overflow in hw/pt-msi.c in Xen 4.6.x and earlier when using the qemu-xen-traditional (aka qemu-dm) device model allows local x86 HVM guest administrators to gain privileges by leveraging a system with access to a passed-through MSI-X capable physical PCI device and MSI-X table entries related to a \write path.\