The flaw arises when a HVM or PVH guest changes the grant table version from v2 to v1 while it simultaneously maps status pages via XENMEM_add_to_physmap. This overlap can cause some mapped status pages to be freed prematurely while still referenced in the guest's P2M page tables, leading to a use‑after‑free that corrupts host memory. The CVE description does not state that this leads to remote code execution, but the data identifies a memory corruption threat at the hypervisor level.

Xen hypervisor installations that have applied the XSA‑379 or XSA‑387 mitigations but have not fully closed the race window are affected. Because the CVE does not list specific version ranges, the risk applies to any Xen system hosting HVM or PVH guests that remain vulnerable to the grant table race condition.

The CVSS score of 7.8 classifies the issue as high severity. The EPSS score is not available and the vulnerability is not listed in CISA KEV, indicating no known active exploitation at the time of analysis. A feasible exploit would require the ability to control a HVM or PVH guest and trigger concurrent grant‑table changes and status page mappings, which is typically a local or privileged attack scenario. The severity rating and memory‑corruption nature imply that a successful attack could compromise host integrity, though explicit remote code execution was not described in the official CVE text.