EDK2: out-of-bounds write and buffer size miscalculation allow code execution in UEFI firmware

Impact

An out-of-bounds write combined with an incorrect buffer-size calculation in EDK2 can be reached by remote access and lead to arbitrary code execution in the UEFI firmware environment, below the operating system. Code that runs there sits under every tenant and every hypervisor on the box, outside the view of host-level detection, and can persist across reinstalls. EDK2 is the upstream of most server UEFI implementations, so the exposure for an operator depends on which OEM builds ship the affected code and on whether the vulnerable path - network-reachable pre-boot services such as PXE or HTTP boot - is enabled on the fleet. The record gives a CVSS 4.0 score of 9.5 with downstream system impact, but does not identify the specific module or the fixed commit.

Who can reach it

Remote per the record, meaning the vulnerable parsing is reachable without local access and without authentication; on servers that in practice means the pre-boot network path during provisioning or boot, on whatever VLAN the node PXE-boots from. Nodes that never network-boot are correspondingly harder to reach.

What to do

No operator-installable fix comes from EDK2 directly - track the TianoCore advisory GHSA-99cj-7hg9-mp4m and wait for your server OEM's BIOS release that picks it up, then flash each affected node with it, which means taking the node out of service and rebooting. Until OEM firmware ships, reduce exposure by keeping the provisioning network isolated and disabling network boot on nodes that do not need it. Do not assume a particular fixed BIOS version; the record names none.

References

Related entries

• Juniper Junos Space: stored XSS lets a low-privileged user run commands as a viewing administratorCVE-2025-59978 · Juniper Junos Space (web UI stored cross-site scripting)Critical
• VeloCloud Orchestrator: any authenticated user can escalate to superuser operatorCVE-2026-114625 · Arista VeloCloud Orchestrator (on-prem)Critical
• Arista EOS gNSI Certz: crafted Rotate request runs arbitrary OS commands as rootCVE-2026-73447 · Arista EOS (gNSI Certz service, also Bootz)Critical
• Arista EOS: gRPC OpenConfig requests authorized at the wrong privilege levelCVE-2026-73461 · Arista EOS (AAA authorization for gRPC/OpenConfig)Critical
• Lantronix console servers: command injection in the NFS download CLI yields root on the out-of-band management deviceCVE-2026-80151 · Lantronix SLC8000/SLC9000/EMG console servers (CLI 'set nfs download' command)Critical
• Arista EOS (redundant supervisor, RPR/SSO): On modular chassis with dual supervisors running RPR or SSO redundancyCVE-2023-24509 · Arista EOS (redundant supervisor, RPR/SSO)Critical