Integer Overflow Vulnerability in UEFI Implementation of EDK2

CVE-2014-4859

What is CVE-2014-4859?

An integer overflow vulnerability exists in the Drive Execution Environment (DXE) phase within the Capsule Update feature of the UEFI implementation found in EDK2. This vulnerability can be exploited by physically proximate attackers, enabling them to craft specific data to bypass intended access controls, potentially compromising the integrity and security of the system.

References