TianoCore EDK2 CVE-2025-2296

Exploitation requires an attacker who already possesses high privileges (CVSS PR:H) and, per the NVD description, local access to the system to deliver crafted input into the EDK2-based BIOS/UEFI component that performs improper input validation (CWE-20). No user interaction is required (UI:N). The specific affected feature, firmware phase, or input path is not named in the available description and should be obtained from the TianoCore advisory. Key limiting factors: the high-privilege prerequisite and the stated local-access requirement significantly constrain realistic attackers; note, however, that the supplied CVSS vector lists AV:N, which conflicts with the description's local-access claim and must be verified with the vendor before assuming remote reachability.

Signals are mixed and the dataset is sparse. The supplied CVSS 4.0 vector (8.4) encodes AV:N/AC:L/AT:N/PR:H/UI:N, which asserts a network attack vector, yet the NVD description explicitly states the attacker requires 'local access' - these directly contradict each other and must be reconciled with the vendor (the GHSA advisory) before treating this as remotely reachable. If local access is correct, real-world risk is materially lower than the 8.4 score implies. PR:H is consistent across interpretations: exploitation requires high privileges, so this is an authenticated/privileged-attacker flaw, not a drive-by. No EPSS probability is provided in the input, so likelihood of exploitation cannot be quantified. There is no CISA KEV listing and no public exploit referenced, so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. Net: a genuinely high technical-impact firmware flaw (arbitrary command execution below the OS) but gated behind high privileges and (per the description) local access, making it a patch-in-due-course item for most environments rather than an emergency - with the explicit caveat that the AV:N/local-access conflict must be resolved to finalize priority.

A local attacker who already holds high privileges on the system supplies maliciously crafted input to a BIOS/UEFI component built on EDK2, triggering the improper input validation (CWE-20). The malformed input alters firmware control flow and allows arbitrary command execution at the firmware level, undermining confidentiality, integrity, and availability beneath the operating system. No public proof-of-concept is referenced in the available data.