CVE-2025-2296
NoneCVSS
—
EPSS
0.8%
Published
Dec 9, 2025
CISA due date
—
The record
EDK2 contains a vulnerability in BIOS where an attacker may cause “ Improper Input Validation” by local access. Successful exploitation of this vulnerability could alter control flow in unexpected ways, potentially allowing arbitrary command execution and impacting Confidentiality, Integrity, and Availability.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | ovmf | 0 | 202602-6.1 |
Related vulnerabilities
- CVE-2026-34874 An issue was discovered in Mbed TLS through 3.6.5 and 4.x through 4.0.0. Also affects ovmf
- CVE-2026-25833 Mbed TLS 3.5.0 to 3.6.5 fixed in 3.6.6 and 4.1.0 has a buffer overflow in the… Also affects ovmf
- CVE-2023-48733 An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2. Also affects ovmf
- CVE-2019-14562 Integer overflow in DxeImageVerificationHandler() EDK II may allow an authenticated user… Also affects ovmf
- CVE-2017-5731 Bounds checking in Tianocompress before November 7, 2017 may allow an authenticated user… Also affects ovmf
- CVE-2018-12178 Buffer overflow in network stack for EDK II may allow unprivileged user to potentially… Also affects ovmf
- CVE-2026-113786 pypdf is a free and open-source pure-python PDF library. CWE-20
- CVE-2026-112081 A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. CWE-20