CVE-2025-2296

Description

EDK2 contains a vulnerability in BIOS where an attacker may cause “ Improper Input Validation” by local access. Successful exploitation of this vulnerability could alter control flow in unexpected ways, potentially allowing arbitrary command execution and impacting Confidentiality, Integrity, and Availability.

PUBLISHED Reserved 2025-03-13 | Published 2025-12-09 | Updated 2025-12-09 | Assigner TianoCore

Problem types

CWE-20 Improper Input Validation

Product status

References

github.com/...e/edk2/security/advisories/GHSA-6pp6-cm5h-86g5

cve.org (CVE-2025-2296)

nvd.nist.gov (CVE-2025-2296)

Download JSON