Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2023-45229

22
FAUCET Score

CVE-2023-45229 is an out-of-bounds read vulnerability in EDK2's Network Package, specifically affecting Tianocore EDK II when processing DHCPv6 Advertise messages containing IA_NA or IA_TA options. This medium-severity vulnerability (CVSS 6.5) allows an adjacent attacker to achieve unauthorized access and potentially compromise confidentiality with low attack complexity and no user interaction. While there is no known public exploit code or active exploitation (KEV: No), the vulnerability has garnered significant community attention and media coverage, indicating its potential impact.

Impacted Technologies

VendorProductVersion(s)CPE
<= 202311CPE matchmatch criteria
cpe:2.3:a:tianocore:edk2:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

6.5MEDIUM

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector
ADJACENT_NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
Exploitability Score
2.8
Impact Score
3.6
CvssVersion
3.1

Exploit Intelligence

EPSS Score
0.94%
Probability of exploitation in next 30 days
EPSS Percentile
57.4%
Percentile rank of EPSS score among Peer Group
As of 2026-07-27
Model: v2026.06.15
This CVE's current EPSS score of 0.0094 is in the 87th percentile among its peer group of 1,802 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (19)

ciscopatch availablevia llm_extracted
View patch
microsoftpatch availablevia msrc
Product: Azure Linux 3.0 ARMFixed in: 20240223gitedc6681206c1-1
microsoftpatch availablevia msrc
Product: azl3 edk2 20240223gitedc6681206c1-1 on Azure Linux 3.0Fixed in: 20240223gitedc6681206c1-1
microsoftpatch availablevia msrc
Product: azl3 edk2 20230301gitf80f052277c8-37 on Azure Linux 3.0Fixed in: 20240223gitedc6681206c1-1
microsoftpatch availablevia msrc
Product: cbl2 edk2 20230301gitf80f052277c8-42 on CBL Mariner 2.0Fixed in: 20230301gitf80f052277c8-42
microsoftpatch availablevia msrc
Product: Azure Linux 3.0 x64Fixed in: 20240223gitedc6681206c1-1
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 x64Fixed in: 1.0.1-3
microsoftpatch availablevia msrc
Product: CBL Mariner 2.0 ARMFixed in: 1.0.1-3
microsoftpatch availablevia msrc
Product: 19678-17086Fixed in: 1.0.1-3
microsoftpatch availablevia msrc
Product: 17374-16823Fixed in: 1.0.1-9
microsoftpatch availablevia msrc
Product: 18131-17084Fixed in: 20240223gitedc6681206c1-1
microsoftpatch availablevia msrc
Product: 17859-17084Fixed in: 20240223gitedc6681206c1-1
microsoftpatch availablevia msrc
Product: 19733-17086Fixed in: 20230301gitf80f052277c8-42
microsoftpatch availablevia msrc
Product: cbl2 hvloader 1.0.1-11 on CBL Mariner 2.0Fixed in: 1.0.1-3
microsoftpatch availablevia msrc
Product: cbl2 hvloader 1.0.1-9 on CBL Mariner 2.0Fixed in: 1.0.1-9
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9Fixed in: edk2-0:20231122-6.el9
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 9.2 Extended Update SupportFixed in: edk2-0:20221207gitfff6d81270b5-9.el9_2.3
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 8Fixed in: edk2-0:20220126gitbb1bba3d77-13.el8_10
View patch
github_advisoryvendor investigatingvia nvd_reference
View patch

Vendor Advisories (4)

ciscollm-cisco-623d3b214f153faeHIGH

HP PC BIOS Security Update for EDK2 NetworkPkg

Oct 24, 2024
microsoft2024-Jun/CVE-2023-45229

CVE-2023-45229

Jun 11, 2024
redhatCVE-2023-45229Moderate

edk2: Integer underflow when processing IA_NA/IA_TA options in a DHCPv6 Advertise message

Jan 16, 2024
microsoft2024-Jan/CVE-2023-45229Moderate

Out-of-Bounds Read in EDK II Network Package

Jan 9, 2024

References

lists.debian.org / debian-lts-announce/2025/06/msg00007.html
kb.cert.org / vuls/id/132380
packetstormsecurity.com / files/176574/PixieFail-Proof-Of-Concepts.html
Third Party AdvisoryVDB Entry
github.com / tianocore/edk2/security/advisories/GHSA-hc6x-cw6p-gj7h
Vendor Advisory
security.netapp.com / advisory/ntap-20240307-0011
openwall.com / lists/oss-security/2024/01/16/2
Mailing ListThird Party Advisory