{
  "cveId": "CVE-2025-2296",
  "url": "https://patchblox.com/security/cve/CVE-2025-2296",
  "summary": "CVE-2025-2296 is fixed in 5 products on 1 platform, first by RHSA-2026:18465, released December 9, 2025. It is not reported as exploited. Patch Radar priority: High.",
  "title": "Un-verified kernel bypass Secure Boot mechanism in direct boot mode",
  "description": "EDK2 contains a vulnerability in BIOS where an attacker may cause \u201C Improper Input Validation\u201D by local access. Successful exploitation of this vulnerability could alter control flow in unexpected ways, potentially allowing arbitrary command execution and impacting Confidentiality, Integrity, and Availability.",
  "published": "2025-12-09T15:00:48Z",
  "severity": "Important",
  "cvss": 8.2,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
  "cwe": "Improper Input Validation",
  "epss": 0.00772,
  "epssPercentile": 0.55912,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-2296",
  "fixes": [
    {
      "platform": "linux",
      "product": "edk2",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "2025.02-1",
      "fix": "DEBIAN-CVE-2025-2296",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-2296",
      "released": "2025-12-09T16:17:41Z"
    },
    {
      "platform": "linux",
      "product": "edk2",
      "release": "Debian 14",
      "fixedVersion": "2025.02-1",
      "fix": "DEBIAN-CVE-2025-2296",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-2296",
      "released": "2025-12-09T16:17:41Z"
    },
    {
      "platform": "linux",
      "product": "edk2",
      "release": "RHEL 10",
      "fixedVersion": "20251114-5.el10_2",
      "fix": "RHSA-2026:18465",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2026-18465",
      "released": "2025-12-09T15:00:48Z"
    },
    {
      "platform": "linux",
      "product": "edk2",
      "release": "rocky 10",
      "fixedVersion": "0:20251114-5.el10",
      "fix": "RLSA-2026:18465",
      "url": "https://patchblox.com/security/fix/linux/rlsa-2026-18465",
      "released": "2026-05-29T16:03:24Z"
    },
    {
      "platform": "linux",
      "product": "edk2-aarch64",
      "release": "almalinux 10",
      "fixedVersion": "20251114-5.el10_2",
      "fix": "ALSA-2026:18465",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-18465",
      "released": "2026-05-19T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "edk2-aarch64",
      "release": "ol 10",
      "fixedVersion": "0:20251114-5.0.1.el10_2",
      "fix": "ELSA-2026-18465",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-18465",
      "released": "2026-07-08T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "edk2-ovmf",
      "release": "almalinux 10",
      "fixedVersion": "20251114-5.el10_2",
      "fix": "ALSA-2026:18465",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-18465",
      "released": "2026-05-19T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "edk2-ovmf",
      "release": "ol 10",
      "fixedVersion": "0:20251114-5.0.1.el10_2",
      "fix": "ELSA-2026-18465",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-18465",
      "released": "2026-07-08T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "edk2-tools",
      "release": "almalinux 10",
      "fixedVersion": "20251114-5.el10_2",
      "fix": "ALSA-2026:18465",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-18465",
      "released": "2026-05-19T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "edk2-tools",
      "release": "ol 10",
      "fixedVersion": "0:20251114-5.0.1.el10_2",
      "fix": "ELSA-2026-18465",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-18465",
      "released": "2026-07-08T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "edk2-tools-doc",
      "release": "almalinux 10",
      "fixedVersion": "20251114-5.el10_2",
      "fix": "ALSA-2026:18465",
      "url": "https://patchblox.com/security/fix/linux/alsa-2026-18465",
      "released": "2026-05-19T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "edk2-tools-doc",
      "release": "ol 10",
      "fixedVersion": "0:20251114-5.0.1.el10_2",
      "fix": "ELSA-2026-18465",
      "url": "https://patchblox.com/security/fix/linux/elsa-2026-18465",
      "released": "2026-07-08T00:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}