CVE-2023-45234

[CVE catalog]

Severity

High · CVSS 8.8CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Published

Jan 16, 2024, 4:15:00 PM UTC

Source

[NVD] · [CVE record]

EPSS

1.19% · Oct 25, 2026

A security weakness was identified in EDK2, the open-source reference implementation of the UEFI specification, revealing a buffer overflow vulnerability. This vulnerability enables an unauthorized attacker within proximity on the network to transmit a specifically crafted DHCPv6 Advertise message. As a consequence, it results in the unauthorized disclosure of information and jeopardizes the availability of the system. edk2: Buffer overflow when processing DNS Servers option in a DHCPv6 Advertise message The discovery of a buffer overflow vulnerability in EDK2, the open-source UEFI implementation, is a significant issue due to its potential impact on system security. This flaw allows an attacker to exploit the system's vulnerability through a specially crafted DHCPv6 Advertise message, leading to unauthorized access, information leakage, and potential compromise of system availability. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.