CVE-2025-2296 — Improper Input Validation in Edk2

CWE-20 — Improper Input Validation8 documents8 sources
Severity
8.4HIGHNVD
EPSS
0.2%
top 53.65%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Tianocore Edk2
Timeline
PublishedDec 9

Description

EDK2 contains a vulnerability in BIOS where an attacker may cause “ Improper Input Validation” by local access. Successful exploitation of this vulnerability could alter control flow in unexpected ways, potentially allowing arbitrary command execution and impacting Confidentiality, Integrity, and Availability.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L

Affected Packages2 packages

▶CVEListV5tianocore/edk2< edk2-stable202502
▶Debiantianocore/edk2< 2025.02-1+1

🔴Vulnerability Details

3
GHSA
GHSA-3f33-424w-8gqc: EDK2 contains a vulnerability in BIOS where an attacker may cause “ Improper Input Validation” by local access↗2025-12-09
▶
CVEList
Un-verified kernel bypass Secure Boot mechanism in direct boot mode↗2025-12-09
▶
OSV
CVE-2025-2296: EDK2 contains a vulnerability in BIOS where an attacker may cause “ Improper Input Validation” by local access↗2025-12-09
▶

📋Vendor Advisories

3
Microsoft
Un-verified kernel bypass Secure Boot mechanism in direct boot mode↗2025-12-09
▶
Red Hat
edk2: EDK2: Improper Input Validation allows arbitrary command execution↗2025-12-09
▶
Debian
CVE-2025-2296: edk2 - EDK2 contains a vulnerability in BIOS where an attacker may cause “ Improper Inp...↗2025
▶

🕵️Threat Intelligence

1
Wiz
CVE-2025-2296 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2025-2296 — Improper Input Validation in Edk2 | cvebase