CVE-2025-2295: Potential iSCSI R2T PDU Vulnerability
Published Mar 14, 2025
·Updated
EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation of this vulnerability may lead to denial of service.
Affected Software
12 affected componentsFixes available
EDK2 EDK2
Microsoft cbl2 hvloader 1.0.1-16
Microsoft azl3 edk2 20240524git3e722403cd16-14
Microsoft cbl2 edk2 20230301gitf80f052277c8-43
Microsoft cbl2 hvloader 1.0.1-13
Microsoft cbl2 edk2 20230301gitf80f052277c8-44
Microsoft cbl2 hvloader 1.0.1-15
Microsoft azl3 edk2 20240524git3e722403cd16-9
Microsoft cbl2 edk2 20230301gitf80f052277c8-45
Microsoft cbl2 edk2 20230301gitf80f052277c8-42
Microsoft azl3 edk2 20240524git3e722403cd16-10
Microsoft cbl2 hvloader 1.0.1-14
Event History
Mar 14, 2025
CVE Published
via MITRE·09:35 PM
Data Sourced
via MITRE·09:35 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·10:15 PM
DescriptionSeverityWeakness
Sep 4, 2025
Data Sourced
via Microsoft·01:04 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-2295?
CVE-2025-2295 has a high severity level due to its potential to cause denial of service.
2
What types of systems are affected by CVE-2025-2295?
CVE-2025-2295 affects systems running the EDK2 firmware.
3
How do I fix CVE-2025-2295?
To mitigate CVE-2025-2295, update your EDK2 firmware to the latest available version.
4
Can CVE-2025-2295 be exploited remotely?
Yes, CVE-2025-2295 can be exploited over a network due to its integer overflow nature.
5
What impact does CVE-2025-2295 have on my system?
Exploitation of CVE-2025-2295 may lead to a denial of service, impacting system availability.