edk2 vulnerabilities
It was discovered that EDK II incorrectly handled CMS key unwrapping in the embedded OpenSSL library. An attacker could possibly use this issue to cause a heap buffer overflow, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS, Ubuntu 24.04 LTS, and Ubuntu 26.04 LTS. (CVE-2026-63072) It was discovered that EDK II incorrectly handled CMP protection verification in the embedded OpenSSL library. An attacker could possibly use this issue to cause a denial of service. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-63076) It was discovered that EDK II incorrectly buffered DTLS records in the embedded OpenSSL library. A remote attacker could possibly use this issue to cause EDK II to consume excessive memory, resulting in a denial of service. (CVE-2026-54874) It was discovered that EDK II incorrectly verified AEAD tags in the embedded OpenSSL library. An attacker could possibly use this issue to cause EDK II to accept forged messages. This issue only affected Ubuntu 24.04 LTS and Ubuntu 26.04 LTS. (CVE-2026-75803)
USN-8865-1
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:USN-8865-1
edk2
Source reference: /affected/0/package/name
- Affected versions
- 0~20150106.5c2d456b-2
Source reference:
/affected/0/versions0~20160104.c2a892d7-1Source reference:
/affected/0/versions0~20160408.ffea0a2c-2Source reference:
/affected/0/versions0~20160408.ffea0a2c-2ubuntu0.1Source reference:
/affected/0/versions0~20160408.ffea0a2c-2ubuntu0.2Source reference:
/affected/0/versions0~20160408.ffea0a2c-2ubuntu0.2+esm1Source reference:
/affected/0/versions0~20160408.ffea0a2c-2ubuntu0.2+esm3Source reference:
/affected/0/versions - Fixed versions
- 0~20160408.ffea0a2c-2ubuntu0.2+esm4
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
edk2
Source reference: /affected/1/package/name
- Affected versions
- 0~20170911.5dfba97c-1
Source reference:
/affected/1/versions0~20171010.234dbcef-1Source reference:
/affected/1/versions0~20171027.76fd5a66-1Source reference:
/affected/1/versions0~20171205.a9212288-1Source reference:
/affected/1/versions0~20180105.0bc94c74-1Source reference:
/affected/1/versions0~20180205.c0d9813c-1Source reference:
/affected/1/versions0~20180205.c0d9813c-2Source reference:
/affected/1/versions0~20180205.c0d9813c-2ubuntu0.1Source reference:
/affected/1/versions0~20180205.c0d9813c-2ubuntu0.2Source reference:
/affected/1/versions0~20180205.c0d9813c-2ubuntu0.3Source reference:
/affected/1/versions0~20180205.c0d9813c-2ubuntu0.3+esm1Source reference:
/affected/1/versions0~20180205.c0d9813c-2ubuntu0.3+esm2Source reference:
/affected/1/versions - Fixed versions
- 0~20180205.c0d9813c-2ubuntu0.3+esm3
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
edk2
Source reference: /affected/2/package/name
- Affected versions
- 0~20190606.20d2e5a1-2ubuntu1
Source reference:
/affected/2/versions0~20190828.37eef910-3Source reference:
/affected/2/versions0~20190828.37eef910-4Source reference:
/affected/2/versions0~20191122.bd85bf54-1Source reference:
/affected/2/versions0~20191122.bd85bf54-1ubuntu1Source reference:
/affected/2/versions0~20191122.bd85bf54-2Source reference:
/affected/2/versions0~20191122.bd85bf54-2ubuntu1Source reference:
/affected/2/versions0~20191122.bd85bf54-2ubuntu2Source reference:
/affected/2/versions0~20191122.bd85bf54-2ubuntu3Source reference:
/affected/2/versions0~20191122.bd85bf54-2ubuntu3.1Source reference:
/affected/2/versions0~20191122.bd85bf54-2ubuntu3.2Source reference:
/affected/2/versions0~20191122.bd85bf54-2ubuntu3.3Source reference:
/affected/2/versions0~20191122.bd85bf54-2ubuntu3.4Source reference:
/affected/2/versions0~20191122.bd85bf54-2ubuntu3.5Source reference:
/affected/2/versions0~20191122.bd85bf54-2ubuntu3.6Source reference:
/affected/2/versions - Fixed versions
- 0~20191122.bd85bf54-2ubuntu3.6+esm1
Source reference:
/affected/2/ranges - Prerequisites
- Not stated in this record
edk2
Source reference: /affected/3/package/name
- Affected versions
- 2021.08~rc0-2
Source reference:
/affected/3/versions2021.08-3Source reference:
/affected/3/versions2021.11~rc1-1Source reference:
/affected/3/versions2021.11-1Source reference:
/affected/3/versions2021.11-2Source reference:
/affected/3/versions2022.02~rc1-1Source reference:
/affected/3/versions2022.02~rc1-1ubuntu1Source reference:
/affected/3/versions2022.02-1Source reference:
/affected/3/versions2022.02-2Source reference:
/affected/3/versions2022.02-3Source reference:
/affected/3/versions2022.02-3ubuntu0.22.04.1Source reference:
/affected/3/versions2022.02-3ubuntu0.22.04.2Source reference:
/affected/3/versions2022.02-3ubuntu0.22.04.3Source reference:
/affected/3/versions2022.02-3ubuntu0.22.04.4Source reference:
/affected/3/versions2022.02-3ubuntu0.22.04.5Source reference:
/affected/3/versions2022.02-3ubuntu0.22.04.6Source reference:
/affected/3/versions - Fixed versions
- 2022.02-3ubuntu0.22.04.7
Source reference:
/affected/3/ranges - Prerequisites
- Not stated in this record
edk2
Source reference: /affected/4/package/name
- Affected versions
- 2023.05-2
Source reference:
/affected/4/versions2023.11-2Source reference:
/affected/4/versions2023.11-3Source reference:
/affected/4/versions2023.11-4Source reference:
/affected/4/versions2023.11-5Source reference:
/affected/4/versions2023.11-6Source reference:
/affected/4/versions2023.11-8Source reference:
/affected/4/versions2024.02-1Source reference:
/affected/4/versions2024.02-2Source reference:
/affected/4/versions2024.02-2ubuntu0.1Source reference:
/affected/4/versions2024.02-2ubuntu0.3Source reference:
/affected/4/versions2024.02-2ubuntu0.4Source reference:
/affected/4/versions2024.02-2ubuntu0.5Source reference:
/affected/4/versions2024.02-2ubuntu0.6Source reference:
/affected/4/versions2024.02-2ubuntu0.7Source reference:
/affected/4/versions2024.02-2ubuntu0.8Source reference:
/affected/4/versions2024.02-2ubuntu0.9Source reference:
/affected/4/versions - Fixed versions
- 2024.02-2ubuntu0.10
Source reference:
/affected/4/ranges - Prerequisites
- Not stated in this record
edk2
Source reference: /affected/5/package/name
- Affected versions
- 2025.02-8ubuntu3
Source reference:
/affected/5/versions2025.11-3ubuntu6Source reference:
/affected/5/versions2025.11-3ubuntu7Source reference:
/affected/5/versions2025.11-3ubuntu7.2Source reference:
/affected/5/versions - Fixed versions
- 2025.11-3ubuntu7.3
Source reference:
/affected/5/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0~20160408.ffea0a2c-2ubuntu0.2+esm4"
}
]
}
],
"package": {
"name": "edk2",
"purl": "pkg:deb/ubuntu/edk2?arch=source&distro=esm-apps-legacy%2Fxenial",
"ecosystem": "Ubuntu:Pro:16.04:LTS"
},
"versions": [
"0~20150106.5c2d456b-2",
"0~20160104.c2a892d7-1",
"0~20160408.ffea0a2c-2",
"0~20160408.ffea0a2c-2ubuntu0.1",
"0~20160408.ffea0a2c-2ubuntu0.2",
"0~20160408.ffea0a2c-2ubuntu0.2+esm1",
"0~20160408.ffea0a2c-2ubuntu0.2+esm3"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8865-1.json",
"cves_map": {
"cves": [
{
"id": "CVE-2026-54874",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "low"
}
]
}
],
"ecosystem": "Ubuntu:Pro:16.04:LTS"
}
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "ovmf",
"binary_version": "0~20160408.ffea0a2c-2ubuntu0.2+esm4"
},
{
"binary_name": "qemu-efi",
"binary_version": "0~20160408.ffea0a2c-2ubuntu0.2+esm4"
}
],
"availability": "Available with Ubuntu Pro with Legacy support add-on: https://ubuntu.com/pro"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0~20180205.c0d9813c-2ubuntu0.3+esm3"
}
]
}
],
"package": {
"name": "edk2",
"purl": "pkg:deb/ubuntu/edk2?arch=source&distro=esm-apps%2Fbionic",
"ecosystem": "Ubuntu:Pro:18.04:LTS"
},
"versions": [
"0~20170911.5dfba97c-1",
"0~20171010.234dbcef-1",
"0~20171027.76fd5a66-1",
"0~20171205.a9212288-1",
"0~20180105.0bc94c74-1",
"0~20180205.c0d9813c-1",
"0~20180205.c0d9813c-2",
"0~20180205.c0d9813c-2ubuntu0.1",
"0~20180205.c0d9813c-2ubuntu0.2",
"0~20180205.c0d9813c-2ubuntu0.3",
"0~20180205.c0d9813c-2ubuntu0.3+esm1",
"0~20180205.c0d9813c-2ubuntu0.3+esm2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8865-1.json",
"cves_map": {
"cves": [
{
"id": "CVE-2026-54874",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "low"
}
]
},
{
"id": "CVE-2026-63072",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
}
],
"ecosystem": "Ubuntu:Pro:18.04:LTS"
}
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "ovmf",
"binary_version": "0~20180205.c0d9813c-2ubuntu0.3+esm3"
},
{
"binary_name": "qemu-efi",
"binary_version": "0~20180205.c0d9813c-2ubuntu0.3+esm3"
},
{
"binary_name": "qemu-efi-aarch64",
"binary_version": "0~20180205.c0d9813c-2ubuntu0.3+esm3"
},
{
"binary_name": "qemu-efi-arm",
"binary_version": "0~20180205.c0d9813c-2ubuntu0.3+esm3"
}
],
"availability": "Available with Ubuntu Pro: https://ubuntu.com/pro"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0~20191122.bd85bf54-2ubuntu3.6+esm1"
}
]
}
],
"package": {
"name": "edk2",
"purl": "pkg:deb/ubuntu/edk2?arch=source&distro=esm-infra%2Ffocal",
"ecosystem": "Ubuntu:Pro:20.04:LTS"
},
"versions": [
"0~20190606.20d2e5a1-2ubuntu1",
"0~20190828.37eef910-3",
"0~20190828.37eef910-4",
"0~20191122.bd85bf54-1",
"0~20191122.bd85bf54-1ubuntu1",
"0~20191122.bd85bf54-2",
"0~20191122.bd85bf54-2ubuntu1",
"0~20191122.bd85bf54-2ubuntu2",
"0~20191122.bd85bf54-2ubuntu3",
"0~20191122.bd85bf54-2ubuntu3.1",
"0~20191122.bd85bf54-2ubuntu3.2",
"0~20191122.bd85bf54-2ubuntu3.3",
"0~20191122.bd85bf54-2ubuntu3.4",
"0~20191122.bd85bf54-2ubuntu3.5",
"0~20191122.bd85bf54-2ubuntu3.6"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8865-1.json",
"cves_map": {
"cves": [
{
"id": "CVE-2026-54874",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "low"
}
]
},
{
"id": "CVE-2026-63072",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
}
],
"ecosystem": "Ubuntu:Pro:20.04:LTS"
}
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "ovmf",
"binary_version": "0~20191122.bd85bf54-2ubuntu3.6+esm1"
},
{
"binary_name": "qemu-efi",
"binary_version": "0~20191122.bd85bf54-2ubuntu3.6+esm1"
},
{
"binary_name": "qemu-efi-aarch64",
"binary_version": "0~20191122.bd85bf54-2ubuntu3.6+esm1"
},
{
"binary_name": "qemu-efi-arm",
"binary_version": "0~20191122.bd85bf54-2ubuntu3.6+esm1"
}
],
"availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2022.02-3ubuntu0.22.04.7"
}
]
}
],
"package": {
"name": "edk2",
"purl": "pkg:deb/ubuntu/edk2?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"2021.08~rc0-2",
"2021.08-3",
"2021.11~rc1-1",
"2021.11-1",
"2021.11-2",
"2022.02~rc1-1",
"2022.02~rc1-1ubuntu1",
"2022.02-1",
"2022.02-2",
"2022.02-3",
"2022.02-3ubuntu0.22.04.1",
"2022.02-3ubuntu0.22.04.2",
"2022.02-3ubuntu0.22.04.3",
"2022.02-3ubuntu0.22.04.4",
"2022.02-3ubuntu0.22.04.5",
"2022.02-3ubuntu0.22.04.6"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8865-1.json",
"cves_map": {
"cves": [
{
"id": "CVE-2026-54874",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "low"
}
]
},
{
"id": "CVE-2026-63072",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
}
],
"ecosystem": "Ubuntu:22.04:LTS"
}
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "ovmf",
"binary_version": "2022.02-3ubuntu0.22.04.7"
},
{
"binary_name": "ovmf-ia32",
"binary_version": "2022.02-3ubuntu0.22.04.7"
},
{
"binary_name": "qemu-efi",
"binary_version": "2022.02-3ubuntu0.22.04.7"
},
{
"binary_name": "qemu-efi-aarch64",
"binary_version": "2022.02-3ubuntu0.22.04.7"
},
{
"binary_name": "qemu-efi-arm",
"binary_version": "2022.02-3ubuntu0.22.04.7"
}
],
"availability": "No subscription required"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2024.02-2ubuntu0.10"
}
]
}
],
"package": {
"name": "edk2",
"purl": "pkg:deb/ubuntu/edk2?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"2023.05-2",
"2023.11-2",
"2023.11-3",
"2023.11-4",
"2023.11-5",
"2023.11-6",
"2023.11-8",
"2024.02-1",
"2024.02-2",
"2024.02-2ubuntu0.1",
"2024.02-2ubuntu0.3",
"2024.02-2ubuntu0.4",
"2024.02-2ubuntu0.5",
"2024.02-2ubuntu0.6",
"2024.02-2ubuntu0.7",
"2024.02-2ubuntu0.8",
"2024.02-2ubuntu0.9"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8865-1.json",
"cves_map": {
"cves": [
{
"id": "CVE-2026-54874",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "low"
}
]
},
{
"id": "CVE-2026-63072",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-63076",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-75803",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
},
{
"type": "Ubuntu",
"score": "low"
}
]
}
],
"ecosystem": "Ubuntu:24.04:LTS"
}
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "efi-shell-aa64",
"binary_version": "2024.02-2ubuntu0.10"
},
{
"binary_name": "efi-shell-arm",
"binary_version": "2024.02-2ubuntu0.10"
},
{
"binary_name": "efi-shell-ia32",
"binary_version": "2024.02-2ubuntu0.10"
},
{
"binary_name": "efi-shell-riscv64",
"binary_version": "2024.02-2ubuntu0.10"
},
{
"binary_name": "efi-shell-x64",
"binary_version": "2024.02-2ubuntu0.10"
},
{
"binary_name": "ovmf",
"binary_version": "2024.02-2ubuntu0.10"
},
{
"binary_name": "ovmf-ia32",
"binary_version": "2024.02-2ubuntu0.10"
},
{
"binary_name": "ovmf-legacy",
"binary_version": "2024.02-2ubuntu0.10"
},
{
"binary_name": "qemu-efi-aarch64",
"binary_version": "2024.02-2ubuntu0.10"
},
{
"binary_name": "qemu-efi-arm",
"binary_version": "2024.02-2ubuntu0.10"
},
{
"binary_name": "qemu-efi-riscv64",
"binary_version": "2024.02-2ubuntu0.10"
}
],
"availability": "No subscription required"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2025.11-3ubuntu7.3"
}
]
}
],
"package": {
"name": "edk2",
"purl": "pkg:deb/ubuntu/edk2?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"2025.02-8ubuntu3",
"2025.11-3ubuntu6",
"2025.11-3ubuntu7",
"2025.11-3ubuntu7.2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/usn/USN-8865-1.json",
"cves_map": {
"cves": [
{
"id": "CVE-2026-54874",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "low"
}
]
},
{
"id": "CVE-2026-63072",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-63076",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
},
{
"type": "Ubuntu",
"score": "medium"
}
]
},
{
"id": "CVE-2026-75803",
"severity": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
},
{
"type": "Ubuntu",
"score": "low"
}
]
}
],
"ecosystem": "Ubuntu:26.04:LTS"
}
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "efi-shell-aa64",
"binary_version": "2025.11-3ubuntu7.3"
},
{
"binary_name": "efi-shell-loongarch64",
"binary_version": "2025.11-3ubuntu7.3"
},
{
"binary_name": "efi-shell-riscv64",
"binary_version": "2025.11-3ubuntu7.3"
},
{
"binary_name": "efi-shell-x64",
"binary_version": "2025.11-3ubuntu7.3"
},
{
"binary_name": "ovmf",
"binary_version": "2025.11-3ubuntu7.3"
},
{
"binary_name": "ovmf-amdsev",
"binary_version": "2025.11-3ubuntu7.3"
},
{
"binary_name": "ovmf-generic",
"binary_version": "2025.11-3ubuntu7.3"
},
{
"binary_name": "ovmf-inteltdx",
"binary_version": "2025.11-3ubuntu7.3"
},
{
"binary_name": "ovmf-legacy",
"binary_version": "2025.11-3ubuntu7.3"
},
{
"binary_name": "qemu-efi-aarch64",
"binary_version": "2025.11-3ubuntu7.3"
},
{
"binary_name": "qemu-efi-loongarch64",
"binary_version": "2025.11-3ubuntu7.3"
},
{
"binary_name": "qemu-efi-riscv64",
"binary_version": "2025.11-3ubuntu7.3"
}
],
"availability": "No subscription required"
}
}
]- Related CVEs
- CVE-2026-54874
Source reference:
/upstreamCVE-2026-63072Source reference:
/upstreamCVE-2026-63076Source reference:
/upstreamCVE-2026-75803Source reference:
/upstream
Publisher severity
No explicit severity was provided.
- Event
- #85735 · Revision 1
- Added to Heist Feed
- Publisher date