Sensitive Information Disclosure in EDK2 BIOS by TianoCore
CVE-2026-18448

5.6MEDIUM

Key Information:

Vendor

Tianocore

Status
Edk2
Vendor
CVE Published:
10 November 2026

What is CVE-2026-18448?

A vulnerability has been identified in the EDK2 BIOS firmware provided by TianoCore, which allows an attacker with local access to potentially expose sensitive information during transient execution. This could lead to unauthorized disclosure of SMRAM (System Management RAM) contents, impacting the confidentiality of critical data. Remediation steps should be taken to mitigate the risk of exploitation.

Affected Version(s)

EDK2 0

References

https://github.com/tianocore/edk2/security/advisories/GHS...

CVSS V4

Score:
5.6
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abdul Lateef Attar
.