CVE Tools

EDK2

46 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for EDK2, a product in the hardware firmware space. Use it to gauge the current risk picture and drill into individual advisories.

EDK2 CVEs per month

Oct 2024 to Sep 2026. Point at a month, or focus the strip and use the arrow keys.
EDK2 CVEs per month
MonthCVEs
2024-100
2024-110
2024-120
2025-010
2025-020
2025-031
2025-041
2025-050
2025-060
2025-070
2025-082
2025-090
2025-100
2025-111
2025-122
2026-010
2026-020
2026-030
2026-040
2026-050
2026-060
2026-070
2026-080
2026-090

Severity

How the 46 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical12%
  • High2556%
  • Medium1840%
  • Low12%

Latest CVEs

The 15 most recently published vulnerabilities affecting EDK2.

  1. CVE-2025-2296Un-verified kernel bypass Secure Boot mechanism in direct boot mode—
  2. CVE-2024-38798Uncleared password keystrokes in circular queue can lead to information disclosure or escalation of privilege7.0
  3. CVE-2025-2486UEFI Shell accessible in AAVMF with Secure Boot enabled on Ubuntu8.8
  4. CVE-2024-38805iSCSI Remote Memory Corruption and Denial of Service6.3
  5. CVE-2025-3770SMM IDT Privilege Escalation Vulnerability7.0
  6. CVE-2024-38797Out-of-bounds Read in HashPeImageByType()4.6
  7. CVE-2025-2295Potential iSCSI R2T PDU Vulnerability3.5
  8. CVE-2024-38796Integer overflow in PeCoffLoaderRelocateImage5.9
  9. CVE-2024-1298Integer Overflow caused by divide by zero during S3 suspension6.0
  10. CVE-2023-49721An insecure default to allow UEFI Shell in EDK2 was left enabled in LXD. This allows an OS-resident attacker to bypass Secure Boot.6.7
  11. CVE-2023-48733An insecure default to allow UEFI Shell in EDK2 was left enabled in Ubuntu's EDK2. This allows an OS-resident attacker to bypass Secure Boot.6.7
  12. CVE-2023-45234Buffer Overflow in EDK II Network Package8.3
  13. CVE-2023-45233Infinite loop in EDK II Network Package7.5
  14. CVE-2023-45232Infinite loop in EDK II Network Package7.5
  15. CVE-2023-45235Buffer Overflow in EDK II Network Package8.3

Product grouping is registry-driven, with AI assist and human review. How it works

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store