CVE-2025-58151: varstored: TOCTOU issues with mapped guest memory

Severity: critical (CVSS 9.4 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-09 · updated 2026-09-29
Weakness: CWE-367

Description

varstored is a component of the Xapi toolstack handling UEFI Variables for a VM. It has a communication path with OVMF inside the VM involving mapping a buffer prepared by OVMF. Within varstored, there were insufficient compiler barriers, creating TOCTOU issues with data in the shared buffer. The exact vulnerable behaviour depends on the code generated by the compiler. In a build of varstored using default settings, the attacker can control an index used in a jump table.

Affected products

Xen varstored: all versions

References

https://xenbits.xen.org/xsa/advisory-478.html
http://www.openwall.com/lists/oss-security/2026/01/27/2
http://xenbits.xen.org/xsa/advisory-478.html

Get alerted when CVE-2025-58151 or the next vulnerability affects your stack