TI-2018-08730 Aliases CVE-2018-12181 GHSA-wf68-vxvr-9r6g

Out-of-bounds write in TianoCore Extensible Firmware Interface Development Kit

LOW 27CWE-787Published 2019-03-27 · Updated 2024-08-05

Key facts

Attack vector: Local
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · High
Fix status: Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat.

Summary

Stack overflow in corrupted bmp for EDK II may allow unprivileged user to potentially enable denial of service or elevation of privilege via local access.

Why it matters now

EPSS 0.00425 37th percentileScored 2026-11-07

Fix Fixed Red Hat: 2 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
TianoCore	Extensible Firmware Interface Development Kit (EDK II)	N/A	—	No fix listed	CNA

Extensible Firmware Interface Development Kit (EDK II) VendorTianoCore Affected N/A Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:tianocore:edk_ii:-:::::::*	not specified by NVD	Vulnerable	TianoCore

cpe:2.3:a:tianocore:edk_ii:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·TianoCore

Remediation

Red Hat 2 advisories

RHSA-2019:3338 Released 2019-11-05 · Red Hat rating Moderate
edk2 security, bug fix, and enhancement update
- Red Hat Enterprise Linux AppStream (v. 8) edk2-20190308git89910a39dcfd-6.el8, edk2-aarch64-20190308git89910a39dcfd-6.el8, edk2-ovmf-20190308git89910a39dcfd-6.el8
RHSA-2019:2125 Released 2019-08-06 · Red Hat rating Moderate
ovmf security and enhancement update
- Red Hat Enterprise Linux Server (v. 7) OVMF-20180508-6.gitee3198e672e2.el7, ovmf-20180508-6.gitee3198e672e2.el7

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2019-03-27
Extensible Firmware Interface Development Kit (EDK II) — FEDORA-2019-bff1cbaba3
4 records Highest priority Priority MEDIUM 2 MEDIUM, 2 LOW
Other records, highest priority first
- TI-2018-08727 Memory corruption in TianoCore Extensible Firmware Interface Development KitPriority MEDIUM 44
- TI-2018-08729 Out-of-bounds write in TianoCore Extensible Firmware Interface Development KitPriority MEDIUM 42
- TI-2018-02649 Logic issue in variable service module for EDK II/UDK2018/UDK2017/UDK2015 may allow an…Priority LOW 34
Show all 4 records → Advisory →
Advisory · 2019-03-27
Extensible Firmware Interface Development Kit (EDK II) — USN-4349-1
3 records Highest priority Priority MEDIUM 2 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2018-08727 Memory corruption in TianoCore Extensible Firmware Interface Development KitPriority MEDIUM 44
- TI-2018-08729 Out-of-bounds write in TianoCore Extensible Firmware Interface Development KitPriority MEDIUM 42
Show all 3 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux AppStream (v. 8)	Fixed	RHSA-2019:3338
Red Hat Enterprise Linux Server (v. 7)	Fixed	RHSA-2019:2125

Timeline

2026-10-02 Threatist record created from CVE-2018-12181
2026-10-03 Alias added: GHSA-wf68-vxvr-9r6g

References

Patch 1

https://edk2-docs.gitbooks.io/security-advisory/content/stack-overflow-on-corrupted-bmp.html

Advisory 6

Other 1

https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03912en_us

TI-2019-00139 Buffer overflow in Extensible Firmware Interface Development Kit CVSS 3.1CRITICAL 9.8
TI-2018-08727 Memory corruption in TianoCore Extensible Firmware Interface Development Kit CVSS 3.0CRITICAL 9.1
TI-2018-08729 Out-of-bounds write in TianoCore Extensible Firmware Interface Development Kit CVSS 3.0HIGH 8.8
TI-2021-09442 BootPerformanceTable pointer is read from an NVRAM variable in PEI. CVSS 3.1HIGH 7.8
TI-2018-08728 Improper configuration in system firmware for EDK II may allow unauthenticated user to… CVSS 3.0HIGH 7.8
TI-2018-02649 Logic issue in variable service module for EDK II/UDK2018/UDK2017/UDK2015 may allow an… CVSS 3.0HIGH 7.8

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences