{"schema_version":"1.7.2","id":"OESA-2026-2774","modified":"2026-08-06T11:11:41Z","published":"2026-06-24T11:11:41Z","upstream":["CVE-2025-2295","CVE-2026-9076"],"summary":"edk2 security update","details":"EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications.\r\n\r\nSecurity Fix(es):\n\nEDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service.(CVE-2025-2295)\n\nIssue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap)\nprocesses attacker-supplied CMS data, an attacker-chosen stream-mode KEK\ncipher can trigger a heap out-of-bounds read in kek_unwrap_key().\n\nImpact summary: A heap buffer over-read may trigger a crash which leads to\nDenial of Service for an application if the input buffer ends at a memory\npage boundary and the following page is unmapped. There is no information\ndisclosure as the over-read bytes are not revealed to the attacker.\n\nThe key unwrapping function performs a check-byte test as specified in the\nRFC that reads 7 bytes from a heap allocation that is based on the wrapped\nkey length from the message. There is a minimum length check based on the\nblock length of the wrapping cipher. However the cipher is selected from\nan OID carried in the attacker's PWRI keyEncryptionAlgorithm with no\nrequirement that the cipher be a block cipher. When an attacker selects\na stream-mode cipher the guard will be ineffective and the allocated buffer\ncontaining the unwrapped key can be too small to fit the check-bytes\nspecified in the RFC and a buffer over-read can happen.\n\nApplications calling CMS_decrypt() or CMS_decrypt_set1_password()\n(equivalently openssl cms -decrypt -pwri_password ...) on untrusted CMS\ndata are vulnerable to this issue. No password knowledge is required: the\nover-read happens during the unwrap attempt before any authentication\nsucceeds.\n\nThe over-read is limited to a few bytes and is not written to output, so\nthere is no information disclosure. Triggering a crash requires the\nallocation to border unmapped memory, which is unlikely with the normal\nallocator.\n\nThe FIPS modules are not affected by this issue.(CVE-2026-9076)","affected":[{"package":{"ecosystem":"openEuler:20.03-LTS-SP4","name":"edk2","purl":"pkg:rpm/openEuler/edk2&distro=openEuler-20.03-LTS-SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"202002-36.oe2003sp4"}]}],"ecosystem_specific":{"aarch64":["edk2-debuginfo-202002-36.oe2003sp4.aarch64.rpm","edk2-debugsource-202002-36.oe2003sp4.aarch64.rpm","edk2-devel-202002-36.oe2003sp4.aarch64.rpm"],"noarch":["edk2-aarch64-202002-36.oe2003sp4.noarch.rpm","edk2-help-202002-36.oe2003sp4.noarch.rpm","edk2-ovmf-202002-36.oe2003sp4.noarch.rpm","python3-edk2-devel-202002-36.oe2003sp4.noarch.rpm"],"src":["edk2-202002-36.oe2003sp4.src.rpm"],"x86_64":["edk2-debuginfo-202002-36.oe2003sp4.x86_64.rpm","edk2-debugsource-202002-36.oe2003sp4.x86_64.rpm","edk2-devel-202002-36.oe2003sp4.x86_64.rpm"]}}],"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2774"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2295"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9076"}],"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}],"database_specific":{"severity":"High"}}