{"id":"CVE-2025-3770","aliases":["AZL-66108","AZL-66119","AZL-66122","DEBIAN-CVE-2025-3770","EUVD-2025-23901","GHSA-vx5v-4gg6-6qxr","OESA-2025-2298","OESA-2025-2299","OESA-2025-2300","OESA-2025-2386","OESA-2025-2387","OESA-2025-2388","UBUNTU-CVE-2025-3770","USN-7894-1"],"status":"published","title":"SMM IDT Privilege Escalation Vulnerability","description":"EDK2 contains a vulnerability in BIOS where an attacker may cause “Protection Mechanism Failure” by local access. Successful exploitation of this vulnerability will lead to arbitrary code execution and impact Confidentiality, Integrity, and Availability.","severity":{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00176,"percentile":0.07233,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-693"],"published":"2025-08-07T00:42:14Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:3","package":"edk2","fixed_in":["20240524git3e722403cd16-9"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"edk2","fixed_in":["20230301gitf80f052277c8-43"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"hvloader","fixed_in":["1.0.1-14"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"edk2","fixed_in":["2025.02-8+deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"edk2","fixed_in":["2025.02-9"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"edk2","fixed_in":["2022.02-3ubuntu0.22.04.4"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"edk2","fixed_in":["2024.02-2ubuntu0.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:25.10","package":"edk2","fixed_in":["2025.02-8ubuntu3"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"edk2","fixed_in":["2025.02-8ubuntu3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20240524git3e722403cd16-9"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20230301gitf80f052277c8-43"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"hvloader","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.1-14"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2022.11-6","2022.11-6+deb12u1","2022.11-6+deb12u2","2023.02-1","2023.02-2","2023.05-1","2023.05-2","2023.08-1","2023.11-1","2023.11-2","2023.11-3","2023.11-4","2023.11-5","2023.11-6","2023.11-7","2023.11-8","2024.02-1","2024.02-2","2024.05-1","2024.05-2","2024.08-1","2024.08-2","2024.08-3","2024.08-4","2024.11-1","2024.11-2","2024.11-3","2024.11-4","2024.11-5","2025.02-1","2025.02-10","2025.02-2","2025.02-3","2025.02-4","2025.02-5","2025.02-6","2025.02-7","2025.02-8","2025.02-9","2025.05-1","2025.05-2","2025.08.01-1","2025.08.01-2","2025.08.01-3","2025.08.01-4","2025.08.01-5","2025.08.01-6","2025.11-1","2025.11-2","2025.11-3","2025.11-4","2025.11-5","2026.02-1","2026.02-2","2026.02-3","2026.05-1","2026.05-2"]},{"source":"osv","ecosystem":"Debian:13","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2025.02-8+deb13u1"}]}],"versions":["2025.02-8"]},{"source":"osv","ecosystem":"Debian:14","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2025.02-9"}]}],"versions":["2025.02-8"]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202308-28.oe2403"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202002-32.oe2003sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202011-28.oe2203sp4"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202308-26.oe2403sp2"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202011-29.oe2203sp3"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202308-25.oe2403sp1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0~20150106.5c2d456b-2","0~20160104.c2a892d7-1","0~20160408.ffea0a2c-2","0~20160408.ffea0a2c-2ubuntu0.1","0~20160408.ffea0a2c-2ubuntu0.2","0~20160408.ffea0a2c-2ubuntu0.2+esm1","0~20160408.ffea0a2c-2ubuntu0.2+esm3","0~20160408.ffea0a2c-2ubuntu0.2+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0~20170911.5dfba97c-1","0~20171010.234dbcef-1","0~20171027.76fd5a66-1","0~20171205.a9212288-1","0~20180105.0bc94c74-1","0~20180205.c0d9813c-1","0~20180205.c0d9813c-2","0~20180205.c0d9813c-2ubuntu0.1","0~20180205.c0d9813c-2ubuntu0.2","0~20180205.c0d9813c-2ubuntu0.3","0~20180205.c0d9813c-2ubuntu0.3+esm1","0~20180205.c0d9813c-2ubuntu0.3+esm2","0~20180205.c0d9813c-2ubuntu0.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0~20190606.20d2e5a1-2ubuntu1","0~20190828.37eef910-3","0~20190828.37eef910-4","0~20191122.bd85bf54-1","0~20191122.bd85bf54-1ubuntu1","0~20191122.bd85bf54-2","0~20191122.bd85bf54-2ubuntu1","0~20191122.bd85bf54-2ubuntu2","0~20191122.bd85bf54-2ubuntu3","0~20191122.bd85bf54-2ubuntu3.1","0~20191122.bd85bf54-2ubuntu3.2","0~20191122.bd85bf54-2ubuntu3.3","0~20191122.bd85bf54-2ubuntu3.4","0~20191122.bd85bf54-2ubuntu3.5","0~20191122.bd85bf54-2ubuntu3.6","0~20191122.bd85bf54-2ubuntu3.6+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2022.02-3ubuntu0.22.04.4"}]}],"versions":["2021.08~rc0-2","2021.08-3","2021.11~rc1-1","2021.11-1","2021.11-2","2022.02~rc1-1","2022.02~rc1-1ubuntu1","2022.02-1","2022.02-2","2022.02-3","2022.02-3ubuntu0.22.04.1","2022.02-3ubuntu0.22.04.2","2022.02-3ubuntu0.22.04.3"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2024.02-2ubuntu0.6"}]}],"versions":["2023.05-2","2023.11-2","2023.11-3","2023.11-4","2023.11-5","2023.11-6","2023.11-8","2024.02-1","2024.02-2","2024.02-2ubuntu0.1","2024.02-2ubuntu0.3","2024.02-2ubuntu0.4","2024.02-2ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2025.02-8ubuntu3"}]}],"versions":["2025.02-3ubuntu2","2025.02-8","2025.02-8ubuntu1","2025.02-8ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2025.02-8ubuntu3"}]}]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2022.02-3ubuntu0.22.04.4"}]}],"versions":["2021.08~rc0-2","2021.08-3","2021.11~rc1-1","2021.11-1","2021.11-2","2022.02~rc1-1","2022.02~rc1-1ubuntu1","2022.02-1","2022.02-2","2022.02-3","2022.02-3ubuntu0.22.04.1","2022.02-3ubuntu0.22.04.2","2022.02-3ubuntu0.22.04.3"],"bundled":30},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2024.02-2ubuntu0.6"}]}],"versions":["2023.05-2","2023.11-2","2023.11-3","2023.11-4","2023.11-5","2023.11-6","2023.11-8","2024.02-1","2024.02-2","2024.02-2ubuntu0.1","2024.02-2ubuntu0.3","2024.02-2ubuntu0.4","2024.02-2ubuntu0.5"],"bundled":30}],"products":[{"vendor":"tianocore","product":"edk2"}],"references":[{"url":"https://github.com/tianocore/edk2/security/advisories/GHSA-vx5v-4gg6-6qxr","tags":["advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-3770","tags":["web","advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-3770","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2298","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38805","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2299","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2300","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2386","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2387","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2388","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-3770","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-3770","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7894-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-3712","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-0778","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-4304","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-4450","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-0215","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-0286","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-0464","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-0465","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-0466","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-2650","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-3446","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-3817","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-5678","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-6237","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-45236","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-45237","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-0727","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-1298","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-2511","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-4741","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-5535","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-6119","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-9143","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-13176","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-38796","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-38797","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-38805","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-2295","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-9232","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-3770","title":"SMM IDT Privilege Escalation Vulnerability","description":"EDK2 contains a vulnerability in BIOS where an attacker may cause “Protection Mechanism Failure” by local access. Successful exploitation of this vulnerability will lead to arbitrary code execution and impact Confidentiality, Integrity, and Availability.","status":"published","published":"2025-08-07T00:42:14.628Z","modified":"2025-08-07T13:28:12.175Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T14:32:39.378527Z"}],"euvd":[{"id":"EUVD-2025-23901","description":"EDK2 contains a vulnerability in BIOS where an attacker may cause “Protection Mechanism Failure” by local access. Successful exploitation of this vulnerability will lead to arbitrary code execution and impact Confidentiality, Integrity, and Availability.","status":"published","published":"2025-08-07T00:42:14Z","modified":"2025-08-07T13:28:12Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:32:00.279926Z"}],"nvd":[{"id":"CVE-2025-3770","description":"EDK2 contains a vulnerability in BIOS where an attacker may cause “Protection Mechanism Failure” by local access. Successful exploitation of this vulnerability will lead to arbitrary code execution and impact Confidentiality, Integrity, and Availability.","status":"published","published":"2025-08-07T01:15:25.713Z","modified":"2026-06-17T09:20:38.573Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-693"],"updated_at":"2026-11-02T14:11:22.319351Z"}],"osv":[{"id":"CVE-2025-3770","description":"EDK2 contains a vulnerability in BIOS where an attacker may cause “Protection Mechanism Failure” by local access. Successful exploitation of this vulnerability will lead to arbitrary code execution and impact Confidentiality, Integrity, and Availability.","status":"published","published":"2025-08-07T01:15:25.713Z","modified":"2026-04-10T05:25:49.680764Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:48.342824Z"},{"id":"DEBIAN-CVE-2025-3770","description":"EDK2 contains a vulnerability in BIOS where an attacker may cause “Protection Mechanism Failure” by local access. Successful exploitation of this vulnerability will lead to arbitrary code execution and impact Confidentiality, Integrity, and Availability.","status":"published","published":"2025-08-07T01:15:25.713Z","modified":"2026-09-01T20:05:46.265144771Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:45.870237Z"},{"id":"OESA-2025-2298","title":"edk2 security update","description":"EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.\r\n\r\nSecurity Fix(es):\n\nEDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service.(CVE-2024-38805)\n\nEDK2 contains a vulnerability in BIOS where an attacker may cause “Protection Mechanism Failure” by local access. Successful exploitation of this vulnerability will lead to arbitrary code execution and impact Confidentiality, Integrity, and Availability.(CVE-2025-3770)","status":"published","published":"2025-09-19T11:09:22Z","modified":"2026-08-18T01:19:10.468659015Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2299","title":"edk2 security update","description":"EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.\r\n\r\nSecurity Fix(es):\n\nEDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service.(CVE-2024-38805)\n\nEDK2 contains a vulnerability in BIOS where an attacker may cause “Protection Mechanism Failure” by local access. Successful exploitation of this vulnerability will lead to arbitrary code execution and impact Confidentiality, Integrity, and Availability.(CVE-2025-3770)","status":"published","published":"2025-09-19T11:09:22Z","modified":"2026-08-18T01:19:10.608642521Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2300","title":"edk2 security update","description":"EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.\r\n\r\nSecurity Fix(es):\n\nEDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service.(CVE-2024-38805)\n\nEDK2 contains a vulnerability in BIOS where an attacker may cause “Protection Mechanism Failure” by local access. Successful exploitation of this vulnerability will lead to arbitrary code execution and impact Confidentiality, Integrity, and Availability.(CVE-2025-3770)","status":"published","published":"2025-09-19T11:09:22Z","modified":"2026-08-18T01:19:10.665211211Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2386","title":"edk2 security update","description":"EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.\r\n\r\nSecurity Fix(es):\n\nEDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service.(CVE-2024-38805)\n\nEDK2 contains a vulnerability in BIOS where an attacker may cause “Protection Mechanism Failure” by local access. Successful exploitation of this vulnerability will lead to arbitrary code execution and impact Confidentiality, Integrity, and Availability.(CVE-2025-3770)","status":"published","published":"2025-10-11T11:09:27Z","modified":"2026-08-18T01:19:12.900723979Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2387","title":"edk2 security update","description":"EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.\r\n\r\nSecurity Fix(es):\n\nEDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service.(CVE-2024-38805)\n\nEDK2 contains a vulnerability in BIOS where an attacker may cause “Protection Mechanism Failure” by local access. Successful exploitation of this vulnerability will lead to arbitrary code execution and impact Confidentiality, Integrity, and Availability.(CVE-2025-3770)","status":"published","published":"2025-10-11T11:09:28Z","modified":"2026-08-18T01:19:12.687473486Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"OESA-2025-2388","title":"edk2 security update","description":"EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.\r\n\r\nSecurity Fix(es):\n\nEDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service.(CVE-2024-38805)\n\nEDK2 contains a vulnerability in BIOS where an attacker may cause “Protection Mechanism Failure” by local access. Successful exploitation of this vulnerability will lead to arbitrary code execution and impact Confidentiality, Integrity, and Availability.(CVE-2025-3770)","status":"published","published":"2025-10-11T11:09:28Z","modified":"2026-08-18T01:19:12.839582966Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"UBUNTU-CVE-2025-3770","description":"EDK2 contains a vulnerability in BIOS where an attacker may cause “Protection Mechanism Failure” by local access. Successful exploitation of this vulnerability will lead to arbitrary code execution and impact Confidentiality, Integrity, and Availability.","status":"published","published":"2025-08-07T01:15:00Z","modified":"2026-10-05T19:21:24.132497366Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:28.829873Z"},{"id":"AZL-66108","title":"CVE-2025-3770 affecting package edk2 for versions less than 20240524git3e722403cd16-9","description":"EDK2 contains a vulnerability in BIOS where an attacker may cause “Protection Mechanism Failure” by local access. Successful exploitation of this vulnerability will lead to arbitrary code execution and impact Confidentiality, Integrity, and Availability.","status":"published","published":"2025-08-07T01:15:25Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:23.841127Z"},{"id":"AZL-66119","title":"CVE-2025-3770 affecting package edk2 for versions less than 20230301gitf80f052277c8-43","description":"EDK2 contains a vulnerability in BIOS where an attacker may cause “Protection Mechanism Failure” by local access. Successful exploitation of this vulnerability will lead to arbitrary code execution and impact Confidentiality, Integrity, and Availability.","status":"published","published":"2025-08-07T01:15:25Z","modified":"2026-04-21T04:37:47.063751Z","updated_at":"2026-11-02T15:28:08.354547Z"},{"id":"AZL-66122","title":"CVE-2025-3770 affecting package hvloader for versions less than 1.0.1-14","description":"EDK2 contains a vulnerability in BIOS where an attacker may cause “Protection Mechanism Failure” by local access. Successful exploitation of this vulnerability will lead to arbitrary code execution and impact Confidentiality, Integrity, and Availability.","status":"published","published":"2025-08-07T01:15:25Z","modified":"2026-04-21T04:37:47.277561Z","updated_at":"2026-11-02T15:28:08.354547Z"},{"id":"USN-7894-1","title":"edk2 vulnerabilities","description":"It was discovered that EDK II was susceptible to a predictable TCP Initial\nSequence Number. An attacker could possibly use this issue to gain\nunauthorized access. This issue only affected Ubuntu 22.04 LTS, and Ubuntu\n24.04 LTS. (CVE-2023-45236, CVE-2023-45237)\n\nIt was discovered that EDK II incorrectly handled S3 sleep. An attacker\ncould possibly use this issue to cause a denial of service. This issue only\naffected Ubuntu 22.04 LTS, and Ubuntu 24.04 LTS. (CVE-2024-1298)\n\nIt was discovered that the EDK II PE/COFF loader incorrectly handled\ncertain memory operations. An attacker could possibly use this issue to\ncause a denial of service, obtain sensitive information, or execute\narbitrary code. This issue only affected Ubuntu 22.04 LTS, and Ubuntu\n24.04 LTS. (CVE-2024-38796)\n\nIt was discovered that the EDK II PE image hashing function incorrectly\nhandled certain memory operations. An attacker could possibly use this\nissue to cause a denial of service, or execute arbitrary code.\n(CVE-2024-38797)\n\nIt was discovered that the EDK II BIOS incorrectly handled certain memory\noperations. An attacker could possibly use this issue to cause a denial of\nservice. (CVE-2024-38805, CVE-2025-2295)\n\nIt was discovered that EDK II incorrectly handled the enabling of MCE. An\nattacker could possibly use this issue to cause a denial of service, or\nexecute arbitrary code. (CVE-2025-3770)\n\nIt was discovered that the OpenSSL library embedded in EDK II contained\nmultiple vulnerabilties. An attacker could possibly use these issues to\ncause a denial of service, obtain sensitive information, or execute\narbitrary code. (CVE-2021-3712, CVE-2022-0778, CVE-2022-4304,\nCVE-2022-4450, CVE-2023-0215, CVE-2023-0286, CVE-2023-0464, CVE-2023-0465,\nCVE-2023-0466, CVE-2023-2650, CVE-2023-3446, CVE-2023-3817, CVE-2023-5678,\nCVE-2023-6237, CVE-2024-0727, CVE-2024-13176, CVE-2024-2511,\nCVE-2024-41996, CVE-2024-4741, CVE-2024-5535, CVE-2024-6119, CVE-2024-9143,\nCVE-2025-9232)","status":"published","published":"2025-11-26T15:05:43Z","modified":"2026-11-09T12:46:35.954753636Z","updated_at":"2026-11-09T12:55:09.79476Z"}]}}