CVE-2025-2296

Name	CVE-2025-2296
Description	EDK2 contains a vulnerability in BIOS where an attacker may cause “ Improper Input Validation” by local access. Successful exploitation of this vulnerability could alter control flow in unexpected ways, potentially allowing arbitrary command execution and impacting Confidentiality, Integrity, and Availability.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
edk2 (PTS)	bullseye	2020.11-2+deb11u2	vulnerable
	bullseye (security)	2020.11-2+deb11u3	vulnerable
	bookworm	2022.11-6+deb12u2	vulnerable
	bookworm (security)	2022.11-6+deb12u1	vulnerable
	trixie	2025.02-8	fixed
	forky	2025.02-9	fixed
	sid	2025.08.01-6	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
edk2	source	(unstable)	2025.02-1

https://github.com/tianocore/edk2/security/advisories/GHSA-6pp6-cm5h-86g5
https://github.com/tianocore/edk2/pull/10628