Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2023-45234

25
FAUCET Score

CVE-2023-45234 is a critical buffer overflow vulnerability in EDK2's Network Package, specifically affecting tianocore edk2. This flaw occurs when processing DNS Servers options within DHCPv6 Advertise messages. With a CVSS score of 8.8 (High), it allows an unauthenticated attacker on the adjacent network to achieve complete loss of confidentiality, integrity, and availability. While there are no public exploits or active exploitation detected, the vulnerability has garnered significant community discussion and media coverage, indicating awareness of its potential impact.

Impacted Technologies

VendorProductVersion(s)CPE
<= 202311CPE matchmatch criteria
cpe:2.3:a:tianocore:edk2:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

8.3HIGH

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H

Attack Vector
ADJACENT_NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
LOW
Availability Impact
HIGH
Exploitability Score
2.8
Impact Score
5.5
CvssVersion
3.1

Exploit Intelligence

EPSS Score
1.20%
Probability of exploitation in next 30 days
EPSS Percentile
64.9%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0120 is in the 80th percentile among its peer group of 1,875 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (32)

ciscopatch availablevia llm_extracted
View patch
microsoftpatch availablevia msrc
Product: Azure Linux 3.0 ARMFixed in: 20240223gitedc6681206c1-1
microsoftpatch availablevia msrc
Product: 18131-17084Fixed in: 20240223gitedc6681206c1-1
microsoftpatch availablevia msrc
Product: 17859-17084Fixed in: 20240223gitedc6681206c1-1
microsoftpatch availablevia msrc
Product: cbl2 edk2 20230301gitf80f052277c8-41 on CBL Mariner 2.0Fixed in: 20230301gitf80f052277c8-40
microsoftpatch availablevia msrc
Product: cbl2 edk2 20230301gitf80f052277c8-40 on CBL Mariner 2.0Fixed in: 20230301gitf80f052277c8-40
microsoftpatch availablevia msrc
Product: cbl2 hvloader 1.0.1-11 on CBL Mariner 2.0Fixed in: 1.0.1-3
microsoftpatch availablevia msrc
Product: cbl2 hvloader 1.0.1-9 on CBL Mariner 2.0Fixed in: 1.0.1-9
microsoftpatch availablevia msrc
Product: azl3 edk2 20240223gitedc6681206c1-1 on Azure Linux 3.0Fixed in: 20240223gitedc6681206c1-1
microsoftpatch availablevia msrc
Product: azl3 edk2 20230301gitf80f052277c8-37 on Azure Linux 3.0Fixed in: 20240223gitedc6681206c1-1
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 x64Fixed in: 20230301gitf80f052277c8-40
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 x64Fixed in: 1.0.1-3
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 ARMFixed in: 20230301gitf80f052277c8-40
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 ARMFixed in: 1.0.1-3
microsoftpatch availablevia msrc
Product: Azure Linux 3.0 x64Fixed in: 20240223gitedc6681206c1-1
microsoftpatch availablevia msrc
Product: 19674-17086Fixed in: 20230301gitf80f052277c8-40
microsoftpatch availablevia msrc
Product: 18132-16823Fixed in: 20230301gitf80f052277c8-40
microsoftpatch availablevia msrc
Product: 19678-17086Fixed in: 1.0.1-3
microsoftpatch availablevia msrc
Product: 17374-16823Fixed in: 1.0.1-9
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.2 Advanced Update SupportFixed in: edk2-0:20190829git37eef91017ad-9.el8_2.4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.2 Telecommunications Update ServiceFixed in: edk2-0:20190829git37eef91017ad-9.el8_2.4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.2 Update Services for SAP SolutionsFixed in: edk2-0:20190829git37eef91017ad-9.el8_2.4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update SupportFixed in: edk2-0:20200602gitca407c7246bf-4.el8_4.5
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.4 Telecommunications Update ServiceFixed in: edk2-0:20200602gitca407c7246bf-4.el8_4.5
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.4 Update Services for SAP SolutionsFixed in: edk2-0:20200602gitca407c7246bf-4.el8_4.5
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.6 Extended Update SupportFixed in: edk2-0:20220126gitbb1bba3d77-2.el8_6.4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8.8 Extended Update SupportFixed in: edk2-0:20220126gitbb1bba3d77-4.el8_8.3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: edk2-0:20230524-4.el9_3.2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9.0 Extended Update SupportFixed in: edk2-0:20220126gitbb1bba3d77-3.el9_0.4
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9.2 Extended Update SupportFixed in: edk2-0:20221207gitfff6d81270b5-9.el9_2.2
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: edk2-0:20220126gitbb1bba3d77-6.el8_9.6
View patch
github_advisoryvendor investigatingvia nvd_reference
View patch

Vendor Advisories (4)

ciscollm-cisco-623d3b214f153faeHIGH

HP PC BIOS Security Update for EDK2 NetworkPkg

Oct 24, 2024
microsoft2024-Sep/CVE-2023-45234

CVE-2023-45234

Sep 10, 2024
redhatCVE-2023-45234Important

edk2: Buffer overflow when processing DNS Servers option in a DHCPv6 Advertise message

Jan 16, 2024
microsoft2024-Jan/CVE-2023-45234Important

Buffer Overflow in EDK II Network Package

Jan 9, 2024

References

lists.debian.org / debian-lts-announce/2025/06/msg00007.html
kb.cert.org / vuls/id/132380
packetstormsecurity.com / files/176574/PixieFail-Proof-Of-Concepts.html
Third Party AdvisoryVDB Entry
github.com / tianocore/edk2/security/advisories/GHSA-hc6x-cw6p-gj7h
Vendor Advisory
lists.fedoraproject.org / archives/list/[email protected]/message/SJ42V7O7F4OU6R7QSQQECLB6LDHKZIMQ
security.netapp.com / advisory/ntap-20240307-0011
openwall.com / lists/oss-security/2024/01/16/2
Mailing List