Product by TianoCore
TianoCore EDK2
45 known vulnerabilities in TianoCore EDK2 (TianoCore), 1 of them actively exploited (CISA KEV).
Key figures
45
Vulnerabilities
1
Actively exploited (KEV)
0
Used by ransomware
3
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-111497 | Out-of-Bounds Write in Google Brotli Decoder In CISA KEValso in 18 other products | 8.1 | |
| Critical | CVE-2026-97631 | Pre-boot RCE in EDK II PXE driver | — | |
| High | CVE-2023-45233 | Infinite loop in EDK II Network Package | 7.5 | |
| High | CVE-2023-45232 | Infinite loop in EDK II Network Package | 7.5 | |
| High | CVE-2021-38575 | TianoCore EDK II: Buffer Underflow | 8.1 | |
| High | CVE-2023-45235 | Buffer Overflow in EDK II Network Package | 8.3 | |
| High | CVE-2023-45230 | Buffer Overflow in EDK II Network Package | 8.3 | |
| High | CVE-2023-45234 | Buffer Overflow in EDK II Network Package | 8.3 | |
| High | CVE-2025-2296 | Un-verified kernel bypass Secure Boot mechanism in direct boot mode | 8.2 | |
| High | CVE-2019-14559 | Extensible Firmware Interface Development Kit (EDK II): Denial of Service | 7.5 | |
| High | CVE-2021-38576 | EDK II: security vulnerability | 7.5 | |
| High | CVE-2021-28213 | TianoCore EDK II: security vulnerability | 7.5 | |
| Critical | CVE-2021-38578 | TianoCore EDK II: Buffer Underflow | 7.4 | |
| Medium | CVE-2023-45229 | Out-of-Bounds Read in EDK II Network Package | 6.5 | |
| Medium | CVE-2019-14553 | Extensible Firmware Interface Development Kit (EDK II): Improper Authentication | 4.9 | |
| High | CVE-2023-45236 | Predictable TCP ISNs in EDK II Network Package | 5.8 | |
| High | CVE-2019-14586 | Extensible Firmware Interface Development Kit (EDK II): Use-After-Free | 8.0 | |
| Medium | CVE-2023-45231 | Out-of-Bounds Read in EDK II Network Package | 6.5 | |
| Medium | CVE-2024-38796 | Integer overflow in PeCoffLoaderRelocateImage | 5.9 | |
| High | CVE-2023-45237 | Use of a Weak PseudoRandom Number Generator in EDK II Network Package | 5.3 | |
| High | CVE-2025-2486 | UEFI Shell accessible in AAVMF with Secure Boot enabled on Ubuntu | 8.8 | |
| Medium | CVE-2019-14587 | Extensible Firmware Interface Development Kit (EDK II): Denial of Service | 6.5 | |
| Medium | CVE-2014-4859 | Phoenix Technologies SCT3: Integer Overflow | 6.8 | |
| Medium | CVE-2024-1298 | Integer Overflow caused by divide by zero during S3 suspension | 6.0 | |
| High | CVE-2021-28216 | TianoCore EDK II: Assignment of a Fixed Address to a Pointer | 7.8 |
News
- 2nd November – Threat Intelligence Reportcheckpoint-research,
- Vulnerabilities in Node.js Affecting Cisco Products: October 2026cisco-psirt,
- Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emergesthehackernews,
- Node2Shell (CVE-2026-111497) in active exploitationsophos-xops,
- Node2Shell puts Microsoft and Node.js on Brotli patch dutycsoonline,
- PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flawthehackernews,