CVE-2025-2296

EDK2 contains a vulnerability in BIOS where an attacker may cause “ Improper Input Validation” by local access. Successful exploitation of this vulnerability could alter control flow in unexpected ways, potentially allowing arbitrary command execution and impacting Confidentiality, Integrity, and Availability.

CVSS

No CVSS.

References

Link	Resource
https://github.com/tianocore/edk2/security/advisories/GHSA-6pp6-cm5h-86g5

Configurations

No configuration.

History

07 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) EDK2 contiene una vulnerabilidad en la BIOS donde un atacante podría causar 'Validación de Entrada Incorrecta' mediante acceso local. La explotación exitosa de esta vulnerabilidad podría alterar el flujo de control de formas inesperadas, lo que podría permitir la ejecución arbitraria de comandos e impactar la Confidencialidad, Integridad y Disponibilidad.

Information

Published : 2025-12-09 16:17

Updated : 2026-10-07 20:10

NVD link : CVE-2025-2296

Mitre link : CVE-2025-2296

CVE.ORG link : CVE-2025-2296

JSON object : View

Products Affected

No product.

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2025-2296", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-2296", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-09T15:11:03.675222Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "infosec@edk2.groups.io", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.4, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "infosec@edk2.groups.io", "affectedData": [{"vendor": "TianoCore", "product": "EDK2", "versions": [{"status": "affected", "version": "0", "lessThan": "edk2-stable202502", "versionType": "Custom"}], "packageName": "OvmfPkg", "defaultStatus": "unaffected"}]}], "published": "2025-12-09T16:17:41.633", "references": [{"url": "https://github.com/tianocore/edk2/security/advisories/GHSA-6pp6-cm5h-86g5", "source": "infosec@edk2.groups.io"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "infosec@edk2.groups.io", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "EDK2 contains a vulnerability in BIOS where an attacker may cause \u201c Improper Input Validation\u201d by local access. Successful exploitation of this vulnerability could alter control flow in unexpected ways, potentially allowing arbitrary command execution and impacting Confidentiality, Integrity, and Availability."}, {"lang": "es", "value": "EDK2 contiene una vulnerabilidad en la BIOS donde un atacante podr\u00eda causar 'Validaci\u00f3n de Entrada Incorrecta' mediante acceso local. La explotaci\u00f3n exitosa de esta vulnerabilidad podr\u00eda alterar el flujo de control de formas inesperadas, lo que podr\u00eda permitir la ejecuci\u00f3n arbitraria de comandos e impactar la Confidencialidad, Integridad y Disponibilidad."}], "lastModified": "2026-10-07T20:10:01.970", "sourceIdentifier": "infosec@edk2.groups.io"}