PT-2026-5017 · Xen+1 · Varstored+1

Teddy Astie · CVE-2025-58151 · Published 2026-01-27 · Updated 2026-07-09

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Xen (affected versions not specified)

Description The varstored component of the Xapi toolstack, which manages UEFI Variables for virtual machines, contains insufficient compiler barriers. This leads to Time-of-Check to Time-of-Use (TOCTOU) issues—a race condition where data is modified between the time it is checked and the time it is used—within a shared buffer used for communication with OVMF inside the VM. Depending on the compiler settings, an attacker may be able to control an index used in a jump table.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Time Of Check To Time Of Use

Weakness Enumeration

CWE-367

Related Identifiers

CVE-2025-58151

Affected Products

Varstored

Xen

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-58151 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2025-58151 · Vendor Advisory
• https://xenbits.xen.org/xsa/advisory-478.html · Note
• https://twitter.com/Intra_Access/status/2016177200219713966 · Twitter Post
• https://twitter.com/autumn_good_35/status/2016195126675316958 · Twitter Post
• https://twitter.com/oss_security/status/2016369566314647751 · Twitter Post
• https://twitter.com/autumn_good_35/status/2016195125270216732 · Twitter Post
• http://xenbits.xen.org/xsa/advisory-478.html · Note
• http://openwall.com/lists/oss-security/2026/01/27/2 · Note
• https://twitter.com/vuldb/status/2016140919146459612 · Twitter Post
• https://security.alpinelinux.org/vuln/CVE-2025-58151 · Note