CVE-2025-2296
Last modified
CVE-2025-2296 is a high-severity vulnerability rated 8.4/10 on the CVSS scale. EDK2 contains a vulnerability in BIOS where an attacker may cause “ Improper Input Validation” by local access. Successful exploitation of this vulnerability could alter control flow in unexpected ways, potentially allowing arbitrary command execution and impacting Confidentiality, Integrity, and Availability.. EPSS estimates a 0.70% chance of exploitation in the next 30 days.
Description
EDK2 contains a vulnerability in BIOS where an attacker may cause “ Improper Input Validation” by local access. Successful exploitation of this vulnerability could alter control flow in unexpected ways, potentially allowing arbitrary command execution and impacting Confidentiality, Integrity, and Availability.
Metrics
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-2296?
How severe is CVE-2025-2296?
How do I fix CVE-2025-2296?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-2295EDK2 contains a vulnerability in BIOS where a user may cause…3.5
- CVE-2025-22952elestio memos v0.23.0 is vulnerable to Server-Side Request F…9.8
- CVE-2025-22953A SQL injection vulnerability exists in Epicor HCM 2021 1.9,…9.8
- CVE-2025-22954GetLateOrMissingIssues in C4/Serials.pm in Koha before 24.11…10
- CVE-2025-22956OPSI before 4.3 allows any client to retrieve any ProductPro…9.8
- CVE-2025-22957A SQL injection vulnerability exists in the front-end of the…9.8
- CVE-2025-22960A session hijacking vulnerability exists in the web-based ma…8
- CVE-2025-22961A critical information disclosure vulnerability exists in th…8
- CVE-2025-22962A critical remote code execution (RCE) vulnerability exists …7.2
- CVE-2025-22963Teedy through 1.11 allows CSRF for account takeover via POST…7.5
- CVE-2025-22964DDSN Interactive cm3 Acora CMS version 10.1.1 has an unauthe…8.1
- CVE-2025-22968An issue in D-Link DWR-M972V 1.05SSG allows a remote attacke…9.8
Are you affected by CVE-2025-2296?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST