CVE-2025-2296 — Un-verified kernel bypass Secure Boot mechanism in direct boot mode

CVE-2025-2296

Un-verified kernel bypass Secure Boot mechanism in direct boot mode PUBLISHED

Description (CNA)

EDK2 contains a vulnerability in BIOS where an attacker may cause “ Improper Input Validation” by local access. Successful exploitation of this vulnerability could alter control flow in unexpected ways, potentially allowing arbitrary command execution and impacting Confidentiality, Integrity, and Availability.

Affected (CNA)

Vendor / product	Versions
TianoCore / EDK2	affected 0 before edk2-stable202502

CWE

CWE-20

References

https://github.com/tianocore/edk2/security/advisories/GHSA-6pp6-cm5h-86g5

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.