VULNERABILITY INTELLIGENCE

CVE-2014-4859

CVSS score6.8 MEDIUM

EPSS probability0.59%

CISA KEVNot currently listed

Published2020-01-31

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

Integer overflow in the Drive Execution Environment (DXE) phase in the Capsule Update feature in the UEFI implementation in EDK2 allows physically proximate attackers to bypass intended access restrictions via crafted data.

Weakness classification

nvd@nist.gov: CWE-190

Primary references

cret@cert.org — Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, US Government Resource