PT-2025-49977 · Edk2+1 · Edk2+1

Published 2024-01-01 · Updated 2025-12-12 · CVE-2024-38798

Positive Technologies (AI Summary)

CVSS v4.0

5.8

Medium

Base vector

AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions EDK2 (affected versions not specified)

Description EDK2 contains a flaw in BIOS that could allow an attacker with local access to expose sensitive information. Successful exploitation may lead to information disclosure or privilege escalation, impacting confidentiality.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2026-05137

CVE-2024-38798

GHSA-Q2C6-37H5-7CWF

Affected Products

Debian

Edk2

References · 14

• https://osv.dev/vulnerability/CVE-2024-38798 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-38798 · Security Note
• https://ubuntu.com/security/CVE-2024-38798 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-05137 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-38798 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-38798 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-38798 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2024-38798 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2026-0518SE47 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-38798 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2026-0421SE17 · Vendor Advisory
• https://github.com/tianocore/edk2/security/advisories/GHSA-q2c6-37h5-7cwf · Note
• https://access.redhat.com/security/cve/cve-2024-38798 · Note
• https://docs.bell-sw.com/security/cves/CVE-2024-38798 · Note