TianoCore.org maintains the EDK2 firmware development kit, which underpins UEFI implementations across a broad range of computing platforms, from servers and desktops to embedded systems, giving its vulnerabilities outsized leverage across the ecosystem despite a narrow direct product count. Vulnerabilities affecting this vendor lean toward serious outcomes, with a meaningful share reaching critical severity, and recur through memory-safety and arithmetic weakness classes including out-of-bounds writes, buffer overflows, and integer overflows that are characteristic of low-level firmware code. The exposure in EDK2 reflects the complexity of implementing UEFI specifications and the challenge of maintaining memory safety in C-based bootloader and system-firmware logic that operates without modern runtime protections. Defenders should treat EDK2 advisories as broadly applicable, since patching often requires coordination across system vendors and firmware distributors rather than direct end-user remediation; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by TianoCore.org over time
Of all the CVEs published by TianoCore.org as a CNA, 70.4% affect products that TianoCore.org develops as a vendor.
Of all the CVEs published that affect products developed by TianoCore.org, 43.2% are self-published by TianoCore.org as a CNA.
Signals from CVEs in this vendor scope (44 CVEs).
44 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-38578CRITICAL Existing CommBuffer checks in SmmEntryPoint will not catch underflow when computing BufferSize. | Mar 3, 2022 | 9.8 | 31 | NO | NO |
CVE-2019-0160CRITICAL Buffer overflow in system firmware for EDK II may allow unauthenticated user to potentially enable escalation of privilege and/or denial of service via network access. | Mar 27, 2019 | 9.8 | 30 | NO | NO |
CVE-2018-12178CRITICAL Buffer overflow in network stack for EDK II may allow unprivileged user to potentially enable escalation of privilege and/or denial of service via network. | Mar 27, 2019 | 9.1 | 29 | NO | NO |
CVE-2018-12180HIGH Buffer overflow in BlockIo service for EDK II may allow an unauthenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via n | Mar 27, 2019 | 8.8 | 28 | NO | NO |
CVE-2025-2486HIGH The Ubuntu edk2 UEFI firmware packages accidentally allowed the UEFI Shell to be accessed in Secure Boot environments, possibly allowing bypass of Secure Boot constraints. Versions | Nov 26, 2025 | 8.8 | 26 | NO | NO |
CVE-2021-38575HIGH NetworkPkg/IScsiDxe has remotely exploitable buffer overflows. | Dec 1, 2021 | 8.1 | 26 | NO | NO |
CVE-2023-45235HIGH EDK2's Network Package is susceptible to a buffer overflow vulnerability when
handling Server ID option
from a DHCPv6 proxy Advertise message. This
vulnerability can be | Jan 16, 2024 | 8.8 | 25 | NO | NO |
CVE-2023-45234HIGH EDK2's Network Package is susceptible to a buffer overflow vulnerability when processing DNS Servers option from a DHCPv6 Advertise message. This
vulnerability can be exploited by | Jan 16, 2024 | 8.8 | 25 | NO | NO |
CVE-2021-28216HIGH BootPerformanceTable pointer is read from an NVRAM variable in PEI. Recommend setting PcdFirmwarePerformanceDataTableS3Support to FALSE. | Aug 5, 2021 | 7.8 | 25 | NO | NO |
CVE-2019-14586HIGH Use after free vulnerability in EDK II may allow an authenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via adjacent a | Nov 23, 2020 | 8.0 | 25 | NO | NO |
Signals from CVEs in this vendor scope (44 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by TianoCore.org.
Media articles that mention a CVE ID that affects a product developed by TianoCore.org — matched by CVE ID, not by vendor name.