CVE-2019-14575

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Logic issue in DxeImageVerificationHandler() for EDK II may allow an authenticated user to potentially enable escalation of privilege via local access.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

VendorProductVersions
n/aExtensible Firmware Interface Development Kit (EDK II)EDK II

References

Timeline

Published
Nov 23, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2019

CVE-2019-14587.8An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k CVE-2019-145847.8Null pointer dereference in Tianocore EDK2 may allow an authenticated user to potentially enable escalation of privilege via local access.CVE-2019-145868.0Use after free vulnerability in EDK II may allow an authenticated user to potentially enable escalation of privilege, information disclosureCVE-2019-145876.5Logic issue EDK II may allow an unauthenticated user to potentially enable denial of service via adjacent access.CVE-2019-145905.5Improper access control in the API for the Intel(R) Graphics Driver versions before 26.20.100.7209 may allow an authenticated user to potentCVE-2019-145915.5Improper input validation in the API for Intel(R) Graphics Driver versions before 26.20.100.7209 may allow an authenticated user to potentiaCVE-2019-145965.5Improper access control in the installer for Intel(R) Chipset Device Software INF Utility before version 10.1.18 may allow an authenticated CVE-2019-145986.7Improper Authentication in subsystem in Intel(R) CSME versions 12.0 through 12.0.48 (IOT only: 12.0.56), versions 13.0 through 13.0.20, versCVE-2019-145997.8Unquoted service path in Control Center-I version 2.1.0.0 and earlier may allow an authenticated user to potentially enable escalation of prCVE-2019-14604.6A spoofing vulnerability exists in the way Microsoft Outlook for Android software parses specifically crafted email messages, aka 'Outlook fCVE-2019-146006.7Uncontrolled search path element in the installer for Intel(R) SNMP Subagent Stand-Alone for Windows* may allow an authenticated user to potCVE-2019-146017.8Improper permissions in the installer for Intel(R) RWC 3 for Windows before version 7.010.009.000 may allow an authenticated user to potenti
CVE-2019-14575: High severity, CVSS 7.8 | Vulnix