What’s Vulnerable › Products
TianoCore edk2 vulnerabilities
43 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 9 published in the last 12 months.
Check whether your TianoCore edk2 version is affected
Exploited TianoCore edk2 vulnerabilities
- CVE-2026-111497 — Out-of-Bounds Write in Google Brotli Decoder
Latest TianoCore edk2 vulnerabilities
- CVE-2026-97631 — Pre-boot RCE in EDK II PXE driver (CVSS 9.5)
- CVE-2026-111497 — Out-of-Bounds Write in Google Brotli Decoder (CVSS 9.8) — exploited
- CVE-2025-2296 — Un-verified kernel bypass Secure Boot mechanism in direct boot mode (CVSS 8.4)
- CVE-2024-38798 — Uncleared password keystrokes in circular queue can lead to information disclosure or escalation of privilege (CVSS 5.8)
- CVE-2025-2486 — UEFI Shell accessible in AAVMF with Secure Boot enabled on Ubuntu (CVSS 8.8)
- CVE-2024-38805 — iSCSI Remote Memory Corruption and Denial of Service (CVSS 6.3)
- CVE-2025-3770 — SMM IDT Privilege Escalation Vulnerability (CVSS 7.0)
- CVE-2024-38797 — Out-of-bounds Read in HashPeImageByType() (CVSS 4.6)
- CVE-2025-2295 — Potential iSCSI R2T PDU Vulnerability (CVSS 3.5)
- CVE-2024-38796 — Integer overflow in PeCoffLoaderRelocateImage (CVSS 5.9)
- CVE-2024-1298 — Integer Overflow caused by divide by zero during S3 suspension (CVSS 6.0)
- CVE-2023-49721 — (CVSS 6.7)
- CVE-2023-48733 — (CVSS 6.7)
- CVE-2023-45237 — Use of a Weak PseudoRandom Number Generator in EDK II Network Package (CVSS 7.5)
- CVE-2023-45236 — Predictable TCP ISNs in EDK II Network Package (CVSS 7.5)
- CVE-2023-45235 — Buffer Overflow in EDK II Network Package (CVSS 8.8)
- CVE-2023-45234 — Buffer Overflow in EDK II Network Package (CVSS 8.8)
- CVE-2023-45233 — Infinite loop in EDK II Network Package (CVSS 7.5)
- CVE-2023-45232 — Infinite loop in EDK II Network Package (CVSS 7.5)
- CVE-2023-45231 — Out-of-Bounds Read in EDK II Network Package (CVSS 6.5)
- CVE-2023-45230 — Buffer Overflow in EDK II Network Package (CVSS 8.8)
- CVE-2023-45229 — Out-of-Bounds Read in EDK II Network Package (CVSS 6.5)
- CVE-2022-36765 — Integer Overflow in CreateHob (CVSS 7.8)
- CVE-2022-36764 — Heap Buffer Overflow in Tcg2MeasurePeImage (CVSS 7.8)
- CVE-2022-36763 — Heap Buffer Overflow in Tcg2MeasureGptTable (CVSS 7.8)