CVE-2025-3770

EUVD-2025-23901
EDK2 contains a vulnerability in BIOS where an attacker may cause “Protection Mechanism Failure” by local access. Successful exploitation of this vulnerability will lead to arbitrary code execution and impact Confidentiality, Integrity, and Availability.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7 HIGH
LOCAL
HIGH
LOW
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: 4.69%
Debian logo
Debian Releases
Debian Product
Codename
edk2
bookworm
no-dsa
bookworm (security)
vulnerable
bullseye
postponed
bullseye (security)
vulnerable
forky
2026.05-2
fixed
sid
2026.05-2
fixed
trixie
2025.02-8+deb13u1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
edk2
bionic
needs-triage
focal
needs-triage
jammy
Fixed 2022.02-3ubuntu0.22.04.4
released
noble
Fixed 2024.02-2ubuntu0.6
released
plucky
Fixed 2025.02-3ubuntu2.2
released
questing
Fixed 2025.02-8ubuntu3
released
resolute
Fixed 2025.02-8ubuntu3
released
xenial
ignored
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
edk2-aarch64
Amazon Linux 2
0:20240813-302.amzn2
fixed
edk2-debuginfo
Amazon Linux 2
0:20240813-302.amzn2
fixed
edk2-ovmf
Amazon Linux 2
0:20240813-302.amzn2
fixed
edk2-tools
Amazon Linux 2
0:20240813-302.amzn2
fixed
edk2-tools-doc
Amazon Linux 2
0:20240813-302.amzn2
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
edk2
Azure Linux 3.0
0:20240524git3e722403cd16-9.azl3
fixed
CBL-Mariner 2.0
0:20230301gitf80f052277c8-43.cm2
fixed
hvloader
CBL-Mariner 2.0
0:1.0.1-14.cm2
fixed
Common Weakness Enumeration
References
https://github.com/tianocore/edk2/security/advisories/GHSA-vx5v-4gg6-6qxr