The weakness, a time‑of‑check to time‑of‑use flaw (CWE‑367), exists in the Xen varstored component of the Xapi toolstack. varstored handles UEFI variable communication between a guest’s OVMF firmware and the host. Insufficient compiler barriers allow a malicious guest to race the shared buffer, controlling an index into an internal jump table and enabling the execution of arbitrary code in the host context, thereby compromising the confidentiality, integrity, and availability of the hypervisor.

The affected product is Xen varstored as part of the Xapi toolstack. Any Xen host that includes varstored compiled with default compiler settings may be vulnerable; the flaw depends on the presence of the shared buffer used by OVMF for UEFI variable handling. All such hosts, regardless of Xen version, are potentially impacted if no patch has been applied.

The CVSS score of 9.4 indicates a critical risk, while the EPSS score of less than 1% suggests a low probability of active exploitation at present. The vulnerability is not listed in the CISA KEV catalog. An attacker is likely to have control over a virtual machine, and by writing malicious data to the UEFI variable interface, can exploit the TOCTOU race in varstored to plant a crafted index. If successful, host‑level code execution is achieved, giving the attacker full control of the hypervisor.