CVE-2025-58151
Severity CVSS v4.0:
CRITICAL
Type:
Unavailable / Other
Publication date:
09/07/2026
Last modified:
09/07/2026
Description
varstored is a component of the Xapi toolstack handling UEFI Variables<br />
for a VM. It has a communication path with OVMF inside the VM involving<br />
mapping a buffer prepared by OVMF.<br />
<br />
Within varstored, there were insufficient compiler barriers, creating<br />
TOCTOU issues with data in the shared buffer.<br />
<br />
The exact vulnerable behaviour depends on the code generated by the<br />
compiler. In a build of varstored using default settings, the attacker<br />
can control an index used in a jump table.
Impact
Base Score 4.0
9.40
Severity 4.0
CRITICAL