CVE catalog

CVE-2026-97631

edk2: CVE-2026-97631

[CVE catalog]

Severity
High · CVSS 8.8CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published
Source
[NVD] · [CVE record]
EPSS
0.43% · Oct 25, 2026

EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality, Integrity, and Availability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianedk2sid2026.08+ds-2vulnerable
Debianedk2forky2026.08+ds-2vulnerable
Debianedk2trixie2025.02-8+deb13u1vulnerable
Debianedk2bookworm2022.11-6+deb12u2vulnerable
Debianedk2bookworm-security2022.11-6+deb12u1vulnerable
Ubuntuedk2pro0~20190606.20d2e5a1-2ubuntu1vulnerable
Ubuntuedk2pro0~20190828.37eef910-3vulnerable
Ubuntuedk2pro0~20190828.37eef910-4vulnerable
Ubuntuedk2pro0~20191122.bd85bf54-1vulnerable
Ubuntuedk2pro0~20191122.bd85bf54-1ubuntu1vulnerable
Ubuntuedk2pro0~20191122.bd85bf54-2vulnerable
Ubuntuedk2pro0~20191122.bd85bf54-2ubuntu1vulnerable
Ubuntuedk2pro0~20191122.bd85bf54-2ubuntu2vulnerable
Ubuntuedk2pro0~20191122.bd85bf54-2ubuntu3vulnerable
Ubuntuedk2pro0~20191122.bd85bf54-2ubuntu3.1vulnerable
Ubuntuedk2pro0~20191122.bd85bf54-2ubuntu3.2vulnerable
Ubuntuedk2pro0~20191122.bd85bf54-2ubuntu3.3vulnerable
Ubuntuedk2pro0~20191122.bd85bf54-2ubuntu3.4vulnerable
Ubuntuedk2pro0~20191122.bd85bf54-2ubuntu3.5vulnerable
Ubuntuedk2pro0~20191122.bd85bf54-2ubuntu3.6vulnerable
Ubuntuedk2pro0~20191122.bd85bf54-2ubuntu3.6+esm1vulnerable
Ubuntuedk222.042021.08~rc0-2vulnerable
Ubuntuedk222.042021.08-3vulnerable
Ubuntuedk222.042021.11~rc1-1vulnerable
Ubuntuedk222.042021.11-1vulnerable
Ubuntuedk222.042021.11-2vulnerable
Ubuntuedk222.042022.02~rc1-1vulnerable
Ubuntuedk222.042022.02~rc1-1ubuntu1vulnerable
Ubuntuedk222.042022.02-1vulnerable
Ubuntuedk222.042022.02-2vulnerable
Ubuntuedk222.042022.02-3vulnerable
Ubuntuedk222.042022.02-3ubuntu0.22.04.1vulnerable
Ubuntuedk222.042022.02-3ubuntu0.22.04.2vulnerable
Ubuntuedk222.042022.02-3ubuntu0.22.04.3vulnerable
Ubuntuedk222.042022.02-3ubuntu0.22.04.4vulnerable
Ubuntuedk222.042022.02-3ubuntu0.22.04.5vulnerable
Ubuntuedk222.042022.02-3ubuntu0.22.04.6vulnerable
Ubuntuedk222.042022.02-3ubuntu0.22.04.7vulnerable
Ubuntuedk224.042023.05-2vulnerable
Ubuntuedk224.042023.11-2vulnerable
Ubuntuedk224.042023.11-3vulnerable
Ubuntuedk224.042023.11-4vulnerable
Ubuntuedk224.042023.11-5vulnerable
Ubuntuedk224.042023.11-6vulnerable
Ubuntuedk224.042023.11-8vulnerable
Ubuntuedk224.042024.02-1vulnerable
Ubuntuedk224.042024.02-2vulnerable
Ubuntuedk224.042024.02-2ubuntu0.1vulnerable
Ubuntuedk224.042024.02-2ubuntu0.3vulnerable
Ubuntuedk224.042024.02-2ubuntu0.4vulnerable
Ubuntuedk224.042024.02-2ubuntu0.5vulnerable
Ubuntuedk224.042024.02-2ubuntu0.6vulnerable
Ubuntuedk224.042024.02-2ubuntu0.7vulnerable
Ubuntuedk224.042024.02-2ubuntu0.8vulnerable
Ubuntuedk224.042024.02-2ubuntu0.9vulnerable
Ubuntuedk224.042024.02-2ubuntu0.10vulnerable
Ubuntuedk226.102025.11-3ubuntu7vulnerable
Ubuntuedk226.102025.11-3ubuntu8vulnerable
Ubuntuedk226.102026.05-2ubuntu1vulnerable
Ubuntuedk226.102026.05-2ubuntu2vulnerable
Ubuntuedk226.102026.05-2ubuntu3vulnerable
Ubuntuedk2-hwe26.102025.11-3ubuntu8vulnerable
Ubuntuedk2-hwe26.102025.11-3ubuntu9vulnerable
Ubuntuedk2-hwe26.102026.05-2ubuntu1vulnerable
Ubuntuedk2-hwe26.102026.05-2ubuntu2vulnerable
Ubuntuedk2-hwe26.102026.05-2ubuntu3vulnerable
Ubuntuedk226.042025.02-8ubuntu3vulnerable
Ubuntuedk226.042025.11-3ubuntu6vulnerable
Ubuntuedk226.042025.11-3ubuntu7vulnerable
Ubuntuedk226.042025.11-3ubuntu7.2vulnerable
Ubuntuedk226.042025.11-3ubuntu7.3vulnerable
Ubuntuedk2-hwe26.042025.11-3ubuntu6vulnerable
Ubuntuedk2-hwe26.042025.11-3ubuntu8vulnerable
Ubuntuedk2-hwe26.042025.11-3ubuntu8.2vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianedk2sourcesid(unfixed)not yet assignedNot reported[1151853]
Debianedk2sourceforky(unfixed)not yet assignedNot reported[1151853]
Debianedk2sourcetrixie(unfixed)not yet assignedNot reported[1151853]
Debianedk2sourcebookworm(unfixed)not yet assignedNot reported[1151853]

[Debian bug #1151853]

Notes

[trixie] edk2: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [ovmf]Affected

    Source package: [edk2]

    Details (4)

    • 2022.11-6+deb12u2 · all · bookworm

      Affected

      dsa · edk2 · debian · bookworm; dsa · edk2 · debian · 12

    • 2022.11-6+deb12u2 · all · bookworm

      Affected

      dsa · edk2 · debian · bookworm; dsa · edk2 · debian · 12

    • 2022.11-6+deb12u1 · all · bookworm-security

      Affected

      dsa · edk2 · debian · bookworm; dsa · edk2 · debian · 12

    • 2022.11-6+deb12u1 · all · bookworm-security

      Affected

      dsa · edk2 · debian · bookworm; dsa · edk2 · debian · 12

  • [ovmf-ia32]Affected

    Source package: [edk2]

    Details (4)

    • 2022.11-6+deb12u2 · all · bookworm

      Affected

      dsa · edk2 · debian · bookworm; dsa · edk2 · debian · 12

    • 2022.11-6+deb12u2 · all · bookworm

      Affected

      dsa · edk2 · debian · bookworm; dsa · edk2 · debian · 12

    • 2022.11-6+deb12u1 · all · bookworm-security

      Affected

      dsa · edk2 · debian · bookworm; dsa · edk2 · debian · 12

    • 2022.11-6+deb12u1 · all · bookworm-security

      Affected

      dsa · edk2 · debian · bookworm; dsa · edk2 · debian · 12

  • [qemu-efi]Affected

    Source package: [edk2]

    Details (4)

    • 2022.11-6+deb12u2 · all · bookworm

      Affected

      dsa · edk2 · debian · bookworm; dsa · edk2 · debian · 12

    • 2022.11-6+deb12u2 · all · bookworm

      Affected

      dsa · edk2 · debian · bookworm; dsa · edk2 · debian · 12

    • 2022.11-6+deb12u1 · all · bookworm-security

      Affected

      dsa · edk2 · debian · bookworm; dsa · edk2 · debian · 12

    • 2022.11-6+deb12u1 · all · bookworm-security

      Affected

      dsa · edk2 · debian · bookworm; dsa · edk2 · debian · 12

  • [qemu-efi-aarch64]Affected

    Source package: [edk2]

    Details (4)

    • 2022.11-6+deb12u2 · all · bookworm

      Affected

      dsa · edk2 · debian · bookworm; dsa · edk2 · debian · 12

    • 2022.11-6+deb12u2 · all · bookworm

      Affected

      dsa · edk2 · debian · bookworm; dsa · edk2 · debian · 12

    • 2022.11-6+deb12u1 · all · bookworm-security

      Affected

      dsa · edk2 · debian · bookworm; dsa · edk2 · debian · 12

    • 2022.11-6+deb12u1 · all · bookworm-security

      Affected

      dsa · edk2 · debian · bookworm; dsa · edk2 · debian · 12

  • [qemu-efi-arm]Affected

    Source package: [edk2]

    Details (4)

    • 2022.11-6+deb12u2 · all · bookworm

      Affected

      dsa · edk2 · debian · bookworm; dsa · edk2 · debian · 12

    • 2022.11-6+deb12u2 · all · bookworm

      Affected

      dsa · edk2 · debian · bookworm; dsa · edk2 · debian · 12

    • 2022.11-6+deb12u1 · all · bookworm-security

      Affected

      dsa · edk2 · debian · bookworm; dsa · edk2 · debian · 12

    • 2022.11-6+deb12u1 · all · bookworm-security

      Affected

      dsa · edk2 · debian · bookworm; dsa · edk2 · debian · 12

[Debian 13 (Trixie)]

  • [efi-shell-aa64]Affected

    Source package: [edk2]

    Details (2)

    • 2025.02-8+deb13u1 · all · trixie

      Affected

      dsa · edk2 · debian · 13

    • 2025.02-8+deb13u1 · all · trixie

      Affected

      dsa · edk2 · debian · 13

  • [efi-shell-arm]Affected

    Source package: [edk2]

    Details (2)

    • 2025.02-8+deb13u1 · all · trixie

      Affected

      dsa · edk2 · debian · 13

    • 2025.02-8+deb13u1 · all · trixie

      Affected

      dsa · edk2 · debian · 13

  • [efi-shell-ia32]Affected

    Source package: [edk2]

    Details (2)

    • 2025.02-8+deb13u1 · all · trixie

      Affected

      dsa · edk2 · debian · 13

    • 2025.02-8+deb13u1 · all · trixie

      Affected

      dsa · edk2 · debian · 13

  • [efi-shell-loongarch64]Affected

    Source package: [edk2]

    Details (2)

    • 2025.02-8+deb13u1 · all · trixie

      Affected

      dsa · edk2 · debian · 13

    • 2025.02-8+deb13u1 · all · trixie

      Affected

      dsa · edk2 · debian · 13

  • [efi-shell-riscv64]Affected

    Source package: [edk2]

    Details (2)

    • 2025.02-8+deb13u1 · all · trixie

      Affected

      dsa · edk2 · debian · 13

    • 2025.02-8+deb13u1 · all · trixie

      Affected

      dsa · edk2 · debian · 13

  • [efi-shell-x64]Affected

    Source package: [edk2]

    Details (2)

    • 2025.02-8+deb13u1 · all · trixie

      Affected

      dsa · edk2 · debian · 13

    • 2025.02-8+deb13u1 · all · trixie

      Affected

      dsa · edk2 · debian · 13

  • [ovmf]Affected

    Source package: [edk2]

    Details (2)

    • 2025.02-8+deb13u1 · all · trixie

      Affected

      dsa · edk2 · debian · 13

    • 2025.02-8+deb13u1 · all · trixie

      Affected

      dsa · edk2 · debian · 13

  • [ovmf-ia32]Affected

    Source package: [edk2]

    Details (2)

    • 2025.02-8+deb13u1 · all · trixie

      Affected

      dsa · edk2 · debian · 13

    • 2025.02-8+deb13u1 · all · trixie

      Affected

      dsa · edk2 · debian · 13

  • [qemu-efi-aarch64]Affected

    Source package: [edk2]

    Details (2)

    • 2025.02-8+deb13u1 · all · trixie

      Affected

      dsa · edk2 · debian · 13

    • 2025.02-8+deb13u1 · all · trixie

      Affected

      dsa · edk2 · debian · 13

  • [qemu-efi-arm]Affected

    Source package: [edk2]

    Details (2)

    • 2025.02-8+deb13u1 · all · trixie

      Affected

      dsa · edk2 · debian · 13

    • 2025.02-8+deb13u1 · all · trixie

      Affected

      dsa · edk2 · debian · 13

  • [qemu-efi-loongarch64]Affected

    Source package: [edk2]

    Details (2)

    • 2025.02-8+deb13u1 · all · trixie

      Affected

      dsa · edk2 · debian · 13

    • 2025.02-8+deb13u1 · all · trixie

      Affected

      dsa · edk2 · debian · 13

  • [qemu-efi-riscv64]Affected

    Source package: [edk2]

    Details (2)

    • 2025.02-8+deb13u1 · all · trixie

      Affected

      dsa · edk2 · debian · 13

    • 2025.02-8+deb13u1 · all · trixie

      Affected

      dsa · edk2 · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]