VULNERABILITY INTELLIGENCE

CVE-2014-4860

CVSS score6.8 MEDIUM

EPSS probability0.50%

CISA KEVNot currently listed

Published2020-01-31

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

Multiple integer overflows in the Pre-EFI Initialization (PEI) boot phase in the Capsule Update feature in the UEFI implementation in EDK2 allow physically proximate attackers to bypass intended access restrictions by providing crafted data that is not properly handled during the coalescing phase.

Weakness classification

CWE-190: Integer Overflow or Wraparound

Primary references

cret@cert.org — Third Party Advisory, US Government Resource
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, US Government Resource