TianoCore edk2
22 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-97631 | ≤ edk2-stable202608 | Pre-boot RCE in EDK II PXE driver | CRITICAL 9.5 | 0.6 % | ||
| CVE-2025-2296 | < edk2-stable202502 | Un-verified kernel bypass Secure Boot mechanism in direct boot mode | HIGH 8.4 | 0.8 % | ||
| CVE-2024-38798 | < edk2-stable202511 | Uncleared password keystrokes in circular queue can lead to information disclosure or escalation of privilege | MEDIUM 5.8 | 0.1 % | ||
| CVE-2024-38805 | ≤ edk2-stable202502 | iSCSI Remote Memory Corruption and Denial of Service | MEDIUM 6.3 | 0.2 % | ||
| CVE-2025-3770 | ≤ edk2-stable202505 | SMM IDT Privilege Escalation Vulnerability | HIGH 7.0 | 0.2 % | ||
| CVE-2024-38797 | ≤ edk2-stable202408 | Out-of-bounds Read in HashPeImageByType() | MEDIUM 4.6 | 0.2 % | ||
| CVE-2025-2295 | ≤ edk2-stable202502 | Potential iSCSI R2T PDU Vulnerability | LOW 3.5 | 0.2 % | ||
| CVE-2024-38796 | ≤ edk2-stable202405 | Integer overflow in PeCoffLoaderRelocateImage | MEDIUM 5.9 | 0.4 % | ||
| CVE-2024-1298 | < edk2-stable202405 | Integer Overflow caused by divide by zero during S3 suspension | MEDIUM 6.0 | 0.2 % | ||
| CVE-2023-45234 | edk2-stable202308 | Buffer Overflow in EDK II Network Package | HIGH 8.8 | 1.2 % | ||
| CVE-2023-45233 | edk2-stable202308 | Infinite loop in EDK II Network Package | HIGH 7.5 | 2.1 % | ||
| CVE-2023-45232 | edk2-stable202308 | Infinite loop in EDK II Network Package | HIGH 7.5 | 2.1 % | ||
| CVE-2023-45235 | edk2-stable202308 | Buffer Overflow in EDK II Network Package | HIGH 8.8 | 1.2 % | ||
| CVE-2023-45237 | edk2-stable202308 | Use of a Weak PseudoRandom Number Generator in EDK II Network Package | HIGH 7.5 | 1.0 % | ||
| CVE-2023-45236 | edk2-stable202308 | Predictable TCP ISNs in EDK II Network Package | HIGH 7.5 | 1.0 % | ||
| CVE-2023-45231 | edk2-stable202308 | Out-of-Bounds Read in EDK II Network Package | MEDIUM 6.5 | 0.8 % | ||
| CVE-2023-45230 | edk2-stable202308 | Buffer Overflow in EDK II Network Package | HIGH 8.8 | 1.2 % | ||
| CVE-2023-45229 | edk2-stable202308 | Out-of-Bounds Read in EDK II Network Package | MEDIUM 6.5 | 1.0 % | ||
| CVE-2022-36765 | * – 202311 | Integer Overflow in CreateHob | HIGH 7.8 | 0.3 % | ||
| CVE-2022-36764 | * – 202311 | Heap Buffer Overflow in Tcg2MeasurePeImage | HIGH 7.8 | 0.3 % | ||
| CVE-2022-36763 | * – 202311 | Heap Buffer Overflow in Tcg2MeasureGptTable | HIGH 7.8 | 0.3 % | ||
| CVE-2014-8271 | before SVN 16280 | Buffer overflow in the Reclaim function in Tianocore EDK2 before SVN 16280 allows physically proximate attackers to gain privileges via a lo | MEDIUM 6.8 | 0.4 % |