edk2 security, bug fix, and enhancement update

An update is available for edk2. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list EDK Embedded Development Kit is a project to enable UEFI support for Virtual...

RLSA-2026:97212 Low: edk2 security, bug fix, and enhancement update

EDK Embedded Development Kit is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fixes: openssl: Use After Free with SSLfreebuffers CVE-2024-4741 Bug Fixes and Enhancements: edk2,rhel-10 rebase to edk2-stable2026...

edk2-security

EDK2 BrotliCustomDecompressLib — heap overflow unfixed A heap-buffer-overflow in EDK2's own Brotli decompression glue MdeModulePkg/Library/BrotliCustomDecompressLib, present since 2017, unfixed at HEAD as of 2026-10-25. ASAN-confirmed with a proof-of-concept and an end-to-end controlled-corruptio...

Rocky Linux 10.2 [CIQ] Security Update: edk2-aarch64 / edk2-debugsource / edk2-ovmf / edk2-tools / etc (crlsa-2026_96240)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202696240 advisory. edk2: Pre-boot RCE in EDK II PXE driver CVE-2026-97631 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that...

CVE-2026-18448

EDK2 contains a vulnerability in BIOS where a privileged attacker may cause “Exposure of Sensitive Information during Transient Execution” by local access. Successful exploitation of this vulnerability may result in disclosure of SMRAM contents. It could also impact Confidentiality...

CVE-2026-14968

EDK2 contains vulnerabilities in BIOS where skilled and privileged users or attackers may cause “Out-of-bounds Write” by local access. Successful exploitation of this vulnerability could compromise SMM handler integrity, cause system instability, and lead to denial of service. It could also impac...

CVE-2026-14968

TianoCore EDK II contains an Out-of-bounds Write vulnerability in the UefiCpuPkg MmSaveStateReadRegisterByIndex function (AmdMmSaveState.c ). This flaw is caused by the improper handling of save-state register widths, which allows a local attacker with SMM privileges on AMD platforms where NeedSy...

CVE-2026-14968

EDK2 contains vulnerabilities in BIOS where skilled and privileged users or attackers may cause “Out-of-bounds Write” by local access. Successful exploitation of this vulnerability could compromise SMM handler integrity, cause system instability, and lead to denial of service. It could also impac...

CVE-2026-18448

EDK2 contains a vulnerability in BIOS where a privileged attacker may cause “Exposure of Sensitive Information during Transient Execution” by local access. Successful exploitation of this vulnerability may result in disclosure of SMRAM contents. It could also impact Confidentiality...

CVE-2026-18448

The EDK2 firmware contains a vulnerability involving insufficient Transient Scheduler Attack (TSA) mitigations . A privileged ring-0 attacker can use local access to infer residual microarchitectural state left by SMM execution . This flaw may lead to the disclosure of SMRAM contents and impact s...

Low: Red Hat Security Advisory: edk2 security, bug fix, and enhancement update

An update for edk2 is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE...

RLSA-2026:96240 Critical: edk2 security update

EDK Embedded Development Kit is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fixes: edk2: Pre-boot RCE in EDK II PXE driver CVE-2026-97631 For more details about the security issues, including the impact, a...

edk2 security update

An update is available for edk2. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list EDK Embedded Development Kit is a project to enable UEFI support for Virtual...

AlmaLinux 10 : edk2 (ALSA-2026:96240)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:96240 advisory. edk2: Pre-boot RCE in EDK II PXE driver CVE-2026-97631 Tenable has extracted the preceding description block directly from the AlmaLinux security advisory. Note...

RockyLinux 10 : edk2 (RLSA-2026:96240)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:96240 advisory. edk2: Pre-boot RCE in EDK II PXE driver CVE-2026-97631 Tenable has extracted the preceding description block directly from the RockyLinux security advisory. Not...

RHEL 10 : edk2 (RHSA-2026:97212)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:97212 advisory. EDK Embedded Development Kit is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU...

HvLoader

HvLoader Overview HvLoader.efi is an EFI application for loading an external hypervisor loader. HvLoader.efi loads a given hypervisor loader binary DLL, EFI, etc., and calls it's entry point passing HvLoader.efi ImageHandle. This way the hypervisor loader binary has access to HvLoader.efi's comma...

Critical: Red Hat Security Advisory: edk2 security update

An update for edk2 is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

edk2: Pre-boot RCE in EDK II PXE driver

A flaw was found in EDK2. Due to improper buffer size calculations in the firmware, an unauthenticated remote attacker can trigger a buffer overflow. Successful exploitation can lead to arbitrary code execution or cause a denial of service DoS...

edk2 security update

20251114-5.0.1.el102.3 - Replace upstream references Orabug:36569119 20251114-5.el102.3 - edk2-NetworkPkg-UefiPxeBcDxe-Fix-ICMP-buffer-overflow-in-.patch RHEL-291254 - Resolves: RHEL-291254 CVE-2026-97631 edk2: Pre-boot RCE in EDK II PXE driver rhel-10.2.z...