Read the docs
TI-2025-02016 Aliases CVE-2025-2296GHSA-3f33-424w-8gqc

Un-verified kernel bypass Secure Boot mechanism in direct boot mode

Priority LOW 38CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · High · Low
Fix status
Partial Red Hat: 2 fixed, 3 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

EDK2 contains a vulnerability in BIOS where an attacker may cause “ Improper Input Validation” by local access. Successful exploitation of this vulnerability could alter control flow in unexpected ways, potentially allowing arbitrary command execution and impacting Confidentiality, Integrity, and Availability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00772 55th percentileScored 2026-11-07
Fix Partial EDK2 (TianoCore): edk2-stable202502Red Hat: 1 advisoryRed Hat: 2 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TianoCoreEDK2before edk2-stable202502edk2-stable202502Patch availableCNA
  • EDK2 VendorTianoCore Affected before edk2-stable202502 Fixed in edk2-stable202502 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:tianocore:edk2:*:*:*:*:*:*:*:*——TianoCore
  • cpe:2.3:a:tianocore:edk2:*:*:*:*:*:*:*:* Versions — — ·TianoCore

Remediation

  • Fix · CNA EDK2 (TianoCore) Fixed in edk2-stable202502

Red Hat 1 advisory

  • RHSA-2026:18465 Released 2026-05-19 · Red Hat rating Important
    edk2 security update
    • Red Hat Enterprise Linux AppStream (v. 10) edk2-20251114-5.el10_2, edk2-aarch64-20251114-5.el10_2, edk2-ovmf-20251114-5.el10_2
    • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) edk2-aarch64-20251114-5.el10_2, edk2-ovmf-20251114-5.el10_2, edk2-tools-20251114-5.el10_2 +1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:18465
Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)Fixed RHSA-2026:18465

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-2296
  2. 2026-10-03 Alias added: GHSA-3f33-424w-8gqc

References

Other 1

  • TI-2026-79288 Out-of-bounds write in Google Brotli decoder KEVCVSS 4.0CRITICAL 9.2
  • TI-2023-24240 Buffer Overflow in EDK II Network Package CVSS 3.1HIGH 8.8
  • TI-2023-24238 Infinite loop in EDK II Network Package CVSS 3.1HIGH 7.5
  • TI-2023-24235 Buffer Overflow in EDK II Network Package CVSS 3.1HIGH 8.8
  • TI-2023-26565 An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2. CVSS 3.1MEDIUM 6.7
  • TI-2023-24236 Out-of-Bounds Read in EDK II Network Package CVSS 3.1MEDIUM 6.5
See all 53 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences