varstored, the component of the Xapi toolstack responsible for handling UEFI variables for virtual machines, contains a time‑of‑check to time‑of‑use flaw caused by missing compiler barriers. The flaw arises when varstored maps a buffer prepared by the guest’s OVMF firmware; due to insufficient ordering guarantees, a malicious guest can manipulate an index used in an internal jump table. The result is the ability to execute arbitrary code in the host context, compromising the integrity and confidentiality of the Xen host.

The affected product is Xen varstored as part of the Xapi toolstack. Any build compiled with default compiler settings may be vulnerable; no specific version numbers are disclosed, so any Xen host that includes varstored is potentially impacted.

The CVSS score of 9.4 indicates a critical risk. The EPSS score of less than 1% suggests a low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The attack is likely triggered from a malicious guest that writes to the UEFI variable interface, exploiting the shared buffer to alter the jump‑table index. Successful exploitation would grant host‑level code execution, allowing the attacker to take full control of the hypervisor.