Improper Input Validation in EDK2 by Tianocore
CVE-2025-2296

8.4HIGH

Key Information:

Vendor

Tianocore

Status
Edk2
Vendor
CVE Published:
9 December 2025

What is CVE-2025-2296?

The EDK2 firmware from Tianocore contains a vulnerability related to improper input validation, which requires local access for exploitation. An attacker exploiting this vulnerability may manipulate the control flow of the firmware in unpredictable ways. This could lead to arbitrary command execution, potentially compromising the confidentiality, integrity, and availability of the system.

Affected Version(s)

EDK2 0

References

https://github.com/tianocore/edk2/security/advisories/GHS...

CVSS V4

Score:
8.4
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.