PT-2025-49981 · Edk2+1 · Edk2+1

Published 2025-01-01 · Updated 2026-05-19 · CVE-2025-2296

Positive Technologies (AI Summary)

CVSS v4.0

8.4

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L

Name of the Vulnerable Software and Affected Versions EDK2 (affected versions not specified)

Description EDK2 contains a flaw in BIOS related to improper input validation. A local attacker may exploit this issue to alter control flow, potentially leading to arbitrary command execution. This could impact the confidentiality, integrity, and availability of the system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALSA-2026:18465

AZL-72545

AZL-72556

AZL-72559

CVE-2025-2296

GHSA-6PP6-CM5H-86G5

OPENSUSE-SU-2026:10467-1

RHSA-2026:18465

Affected Products

Debian

Edk2

References · 24

• https://osv.dev/vulnerability/UBUNTU-CVE-2025-2296 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-2296 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-2296 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-2296 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-2296 · Security Note
• https://errata.almalinux.org/10/ALSA-2026-18465.html · Vendor Advisory
• https://osv.dev/vulnerability/AZL-72556 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-72545 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-2296 · Security Note
• https://ubuntu.com/security/CVE-2025-2296 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:10467-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2026:18465 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-72559 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2025-2296 · Vendor Advisory
• https://github.com/tianocore/edk2/security/advisories/GHSA-6pp6-cm5h-86g5 · Note