TianoCore
Vulnerability activity for TianoCore: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 3
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 1
Last 90 days
- CVEs
- 3
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 1
Last 365 days
- CVEs
- 4
- Critical (CVSS 9+)
- 1
- Exploited (CISA KEV)
- 0
- With exploit code
- 1
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 5.6MediumNov 10, 2026TianoCore EDK2 Information disclosureCVE-2026-18448EDK2 contains a vulnerability in BIOS where a privileged attacker may cause “Exposure of Sensitive Information during Transient Execution” by local access. Successful exploitation of this vulnerability may result in disclosure of SMRAM contents. It could also impact Confidentiality.
- 7.0HighNov 10, 2026TianoCore EDK2 Memory corruptionCVE-2026-14968EDK2 contains vulnerabilities in BIOS where skilled and privileged users or attackers may cause “Out-of-bounds Write” by local access. Successful exploitation of this vulnerability could compromise SMM handler integrity, cause system instability, and lead to denial of service. It could also impact Integrity and Availability.
- 9.5CriticalOct 22, 2026TianoCore EDK2 Memory corruptionCVE-2026-97631EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality, Integrity, and Availability.Exploit code
- 8.8HighNov 26, 2025Tianocore edk2CVE-2025-2486The Ubuntu edk2 UEFI firmware packages accidentally allowed the UEFI Shell to be accessed in Secure Boot environments, possibly allowing bypass of Secure Boot constraints. Versions 2024.05-2ubuntu0.3 and 2024.02-2ubuntu0.3 disable the Shell. Some previous versions inserted a secure-boot-based decision to continue running inside the Shell itself, which is believed to be sufficient to enforce Secure Boot restrictions. This is an additional repair on top of the incomplete fix for CVE-2023-48733.
- 6.7MediumJun 11, 2021TianoCore EDK II Memory corruptionCVE-2021-28211A heap overflow in LzmaUefiDecompressGetInfo function in EDK II.
Top products
- EDK24 CVEs in the last year, 1 critical
Advisories
Official advisories from the last 90 days that name this vendor's CVEs.
- oss-security · Oct 28, 2026CVE-2026-97631: Pre-boot RCE in EDK II PXE driverCVE-2026-97631
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.