Tianocore vulnerabilities

Products

• Edk2 43
• Edk Ii 11
• Edk Ii 7

Newest

• tianocore edk2 Pre-boot RCE in EDK II PXE driver CVE-2026-97631 Public exploit 9.5 CriticalOctober 22, 2026
• andybalholm brotli, 7-zip p7zip, anthropic bun +39 more +41 more Out-of-Bounds Write in Google Brotli Decoder CVE-2026-111497 In KEVPublic exploitFix available EPSS 82.6% 9.2 CriticalApril 27, 2026
• tianocore edk2 Un-verified kernel bypass Secure Boot mechanism in direct boot mode CVE-2025-2296 Fix available 8.4 HighDecember 9, 2025
• tianocore edk2 Uncleared password keystrokes in circular queue can lead to information disclosure or escalation of privilege CVE-2024-38798 Fix available 5.8 MediumDecember 9, 2025
• tianocore edk2 UEFI Shell accessible in AAVMF with Secure Boot enabled on Ubuntu CVE-2025-2486 Fix available 3.7 LowNovember 26, 2025
• tianocore edk2 SMM IDT Privilege Escalation Vulnerability CVE-2025-3770 Fix available 7.0 HighAugust 7, 2025
• tianocore edk2 iSCSI Remote Memory Corruption and Denial of Service CVE-2024-38805 Fix available 6.3 MediumJuly 3, 2025
• tianocore edk2 Out-of-bounds Read in HashPeImageByType() CVE-2024-38797 Fix available 4.6 MediumApril 7, 2025
• tianocore edk2 Potential iSCSI R2T PDU Vulnerability CVE-2025-2295 Fix available 3.5 LowMarch 14, 2025
• tianocore edk2 Integer overflow in PeCoffLoaderRelocateImage CVE-2024-38796 Fix available 5.9 MediumSeptember 27, 2024
• tianocore edk2 Integer Overflow caused by divide by zero during S3 suspension CVE-2024-1298 Fix available 6.0 MediumMay 30, 2024
• canonical lxd, tianocore edk2 +1 more An insecure default to allow UEFI Shell in EDK2 was left enabled in LXD. This allows an OS... CVE-2023-49721 Fix available 6.7 MediumFebruary 14, 2024
• tianocore edk2, canonical lxd, canonical ltd. ubuntu edk ii +1 more +3 more An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2. This allows an... CVE-2023-48733 Fix available 6.7 MediumFebruary 14, 2024
• tianocore edk2 Buffer Overflow in EDK II Network Package CVE-2023-45234 Fix available 8.3 HighJanuary 16, 2024
• tianocore edk2 Infinite loop in EDK II Network Package CVE-2023-45233 Fix available 7.5 HighJanuary 16, 2024
• tianocore edk2 Infinite loop in EDK II Network Package CVE-2023-45232 Fix available 7.5 HighJanuary 16, 2024
• tianocore edk2 Buffer Overflow in EDK II Network Package CVE-2023-45235 Fix available 8.3 HighJanuary 16, 2024
• tianocore edk2 Use of a Weak PseudoRandom Number Generator in EDK II Network Package CVE-2023-45237 Fix available 5.3 MediumJanuary 16, 2024
• tianocore edk2 Predictable TCP ISNs in EDK II Network Package CVE-2023-45236 Fix available 5.8 MediumJanuary 16, 2024
• tianocore edk2 Out-of-Bounds Read in EDK II Network Package CVE-2023-45231 Fix available 6.5 MediumJanuary 16, 2024
• tianocore edk2 Buffer Overflow in EDK II Network Package CVE-2023-45230 Fix available 8.3 HighJanuary 16, 2024
• tianocore edk2 Out-of-Bounds Read in EDK II Network Package CVE-2023-45229 Fix available 6.5 MediumJanuary 16, 2024
• tianocore edk2 Integer Overflow in CreateHob CVE-2022-36765 Fix available 7.0 HighJanuary 9, 2024
• tianocore edk2 Heap Buffer Overflow in Tcg2MeasurePeImage CVE-2022-36764 Fix available 7.0 HighJanuary 9, 2024
• tianocore edk2 Heap Buffer Overflow in Tcg2MeasureGptTable CVE-2022-36763 Fix available 7.0 HighJanuary 9, 2024
• insyde kernel, tianocore edk ii, edk2 +2 more Existing CommBuffer checks in SmmEntryPoint will not catch underflow when computing BufferSize. CVE-2021-38578 Fix available 7.4 HighMarch 3, 2022
• tianocore edk ii, edk2 +1 more A BIOS bug in firmware for a particular PC model leaves the Platform authorization value empty.... CVE-2021-38576 Fix available 7.5 HighJanuary 3, 2022
• insyde kernel, tianocore edk ii, edk2 +2 more NetworkPkg/IScsiDxe has remotely exploitable buffer overflows. CVE-2021-38575 Fix available 8.1 HighAugust 10, 2021
• tianocore edk ii BootPerformanceTable pointer is read from an NVRAM variable in PEI. Recommend setting... CVE-2021-28216 Fix available 7.8 HighAugust 5, 2021
• tianocore edk ii Insufficient input validation in MdeModulePkg in EDKII may allow an unauthenticated user to... CVE-2019-11098 Fix available 6.8 MediumJuly 14, 2021
• tianocore edk2, edk ii +1 more Example EDK2 encrypted private key in the IpSecDxe.efi present potential security risks. CVE-2021-28213 Fix available 7.5 HighJune 11, 2021
• tianocore edk ii, edk2 +1 more A heap overflow in LzmaUefiDecompressGetInfo function in EDK II. CVE-2021-28211 Fix available 6.7 MediumMarch 16, 2021
• tianocore edk ii, edk2 +1 more An unlimited recursion in DxeCore in EDK II. CVE-2021-28210 Fix available 7.8 HighMarch 16, 2021
• debian linux, extensible firmware interface development kit (edk ii) firmware interface development kit (edk ii), tianocore edk2 +2 more Integer overflow in DxeImageVerificationHandler() EDK II may allow an authenticated user to... CVE-2019-14562 Fix available 5.5 MediumSeptember 21, 2020
• extensible firmware interface development kit (edk ii) firmware interface development kit (edk ii), tianocore edk2 +1 more Improper authentication in EDK II may allow a privileged user to potentially enable information... CVE-2019-14553 Fix available 4.9 MediumMarch 3, 2020
• tianocore edk2 Buffer overflow in the Reclaim function in Tianocore EDK2 before SVN 16280 allows physically... CVE-2014-8271 6.8 MediumFebruary 6, 2020
• tianocore edk2, american megatrends incorporated (ami) bios, phoenix technologies ltd. sct3 +2 more Integer overflow in the Drive Execution Environment (DXE) phase in the Capsule Update feature in... CVE-2014-4859 6.8 MediumJanuary 31, 2020
• tianocore edk2, american megatrends incorporated (ami) bios, phoenix technologies ltd. sct3 +2 more Multiple integer overflows in the Pre-EFI Initialization (PEI) boot phase in the Capsule Update... CVE-2014-4860 6.8 MediumJanuary 31, 2020
• debian linux, extensible firmware interface development kit (edk ii) firmware interface development kit (edk ii), tianocore edk2 +2 more Logic issue EDK II may allow an unauthenticated user to potentially enable denial of service via... CVE-2019-14587 Fix available 6.5 MediumDecember 31, 2019
• debian linux, extensible firmware interface development kit (edk ii) firmware interface development kit (edk ii), tianocore edk2 +2 more Use after free vulnerability in EDK II may allow an authenticated user to potentially enable... CVE-2019-14586 Fix available 8.0 HighDecember 31, 2019
• tianocore edk2 Null pointer dereference in Tianocore EDK2 may allow an authenticated user to potentially enable... CVE-2019-14584 Fix available 7.8 HighDecember 31, 2019
• debian linux, extensible firmware interface development kit (edk ii) firmware interface development kit (edk ii), tianocore edk2 +2 more Logic issue in DxeImageVerificationHandler() for EDK II may allow an authenticated user to... CVE-2019-14575 Fix available 7.8 HighDecember 31, 2019
• debian linux, extensible firmware interface development kit (edk ii) firmware interface development kit (edk ii), tianocore edk2 +2 more Integer truncation in EDK II may allow an authenticated user to potentially enable escalation of... CVE-2019-14563 Fix available 7.8 HighDecember 31, 2019
• extensible firmware interface development kit (edk ii) firmware interface development kit (edk ii), tianocore edk2 +1 more Uncontrolled resource consumption in EDK II may allow an unauthenticated user to potentially... CVE-2019-14559 Fix available 7.5 HighDecember 31, 2019
• tianocore edk ii, extensible firmware interface development kit (edk ii) firmware interface development kit (edk ii) +1 more Stack overflow in XHCI for EDK II may allow an unauthenticated user to potentially enable denial... CVE-2019-0161 Fix available 5.5 MediumMarch 27, 2019
• tianocore edk ii, extensible firmware interface development kit (edk ii) firmware interface development kit (edk ii) +1 more Improper configuration in system firmware for EDK II may allow unauthenticated user to... CVE-2018-12179 Fix available 7.8 HighMarch 27, 2019
• tianocore edk ii, extensible firmware interface development kit (edk ii) firmware interface development kit (edk ii) +1 more Insufficient memory write check in SMM service for EDK II may allow an authenticated user to... CVE-2018-12182 Fix available 6.7 MediumMarch 27, 2019
• tianocore edk ii, extensible firmware interface development kit (edk ii) firmware interface development kit (edk ii) +1 more Stack overflow in DxeCore for EDK II may allow an unauthenticated user to potentially enable... CVE-2018-12183 Fix available 6.8 MediumMarch 27, 2019
• tianocore edk ii, extensible firmware interface development kit (edk ii) firmware interface development kit (edk ii), fedoraproject fedora +6 more +8 more Buffer overflow in system firmware for EDK II may allow unauthenticated user to potentially... CVE-2019-0160 Fix available 8.7 HighMarch 27, 2019
• tianocore edk ii, extensible firmware interface development kit (edk ii) firmware interface development kit (edk ii) +1 more Stack overflow in corrupted bmp for EDK II may allow unprivileged user to potentially enable... CVE-2018-12181 Fix available 6.0 MediumMarch 26, 2019
• Show olderLoading…