What’s Vulnerable › Vulnerabilities
CVE-2024-38798: Uncleared password keystrokes in circular queue can lead to information disclosure or escalation of privilege
- Severity: medium (CVSS 5.8 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.1% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-12-09 · updated 2026-10-02
- Weakness: CWE-200
Description
EDK2 contains a vulnerability in BIOS where an attacker may cause “Exposure of Sensitive Information to an Unauthorized Actor” by local access. Successful exploitation of this vulnerability will lead to possible information disclosure or escalation of privilege and impact Confidentiality.
Affected products
- TianoCore edk2: before edk2-stable202511 — fixed in edk2-stable202511
How to fix
Upgrade to a fixed version: TianoCore edk2 edk2-stable202511. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-38798 or the next vulnerability affects your stack