CVE-2014-4860

6.8 mediumEPSS 0.5%

Multiple integer overflows in the Pre-EFI Initialization (PEI) boot phase in the Capsule Update feature in the UEFI implementation in EDK2 allow physically proximate attackers to bypass intended access restrictions by providing crafted data that is not properly handled during the coalescing phase.

Severity

CVSS 3.1

6.8 medium

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 43% of CVEs (scores of 2026-10-31)
CWE: CWE-190
Published: 2020-01-31
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

tianocore:edk2

References

http://www.kb.cert.org/vuls/id/552286
http://www.kb.cert.org/vuls/id/552286

Check your stack JSON