Answer in brief
CVE-2025-58151 records a Critical severity (CVSS 9.4) vulnerability in varstored: TOCTOU issues with mapped guest memory. The current sources do not mark it as known exploited. The current feed maps Xen/varstored (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.4. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Xen/varstored (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Xen/varstoredgeneric | all | Not reported |
Published upstream
Jul 9, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jul 9, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 9, 2026
varstored is a component of the Xapi toolstack handling UEFI Variables for a VM. It has a communication path with OVMF inside the VM involving mapping a buffer prepared by OVMF. Within varstored, there were insufficient compiler barriers, creating TOCTOU issues with data in the shared buffer. The exact vulnerable behaviour depends on the code generated by the compiler. In a build of varstored using default settings, the attacker can control an index used in a jump table.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2025-58151 records a Critical severity (CVSS 9.4) vulnerability in varstored: TOCTOU issues with mapped guest memory. The current sources do not mark it as known exploited. The current feed maps Xen/varstored (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.4. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Xen/varstored (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Xen/varstoredgeneric | all | Not reported |
Published upstream
Jul 9, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jul 9, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 9, 2026
varstored is a component of the Xapi toolstack handling UEFI Variables for a VM. It has a communication path with OVMF inside the VM involving mapping a buffer prepared by OVMF. Within varstored, there were insufficient compiler barriers, creating TOCTOU issues with data in the shared buffer. The exact vulnerable behaviour depends on the code generated by the compiler. In a build of varstored using default settings, the attacker can control an index used in a jump table.
Quoted source text, attributed separately from HOL analysis.