CVE-2022-36765

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

EDK2 is susceptible to a vulnerability in the CreateHob() function, allowing a user to trigger a integer overflow to buffer overflow via a local network. Successful exploitation of this vulnerability may result in a compromise of confidentiality, integrity, and/or availability.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-680CWE-119

Affected software

VendorProductVersions
TianoCoreedk2<= 202311

References

Timeline

Published
Jan 9, 2024
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-367687.8IBM AIX 7.1, 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout command to obtain rooCVE-2022-367697.2IBM Cloud Pak for Data 4.5 and 4.6 could allow a privileged user to upload malicious files of dangerous types that can be automatically procCVE-2022-36776.5The Advanced Import WordPress plugin before 1.3.8 does not have CSRF check when installing and activating plugins, which could allow attackeCVE-2022-367716.5IBM QRadar User Behavior Analytics could allow an authenticated user to obtain sensitive information from that they should not have access tCVE-2022-367726.5IBM InfoSphere Information Server 11.7 could allow an authenticated user to obtain sensitive information that should only be available to a CVE-2022-367738.1IBM Cognos Analytics 11.1.7, 11.2.0, and 11.2.1 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A rCVE-2022-367745.3IBM Robotic Process Automation 21.0.0, 21.0.1, and 21.0.2 is vulnerable to man in the middle attacks through manipulation of the client proxCVE-2022-367756.5IBM Security Verify Access 10.0.0.0, 10.0.1.0, 10.0.2.0, 10.0.3.0, and10.0.4.0 is vulnerable to HTTP header injection, caused by improper vaCVE-2022-367765.4IBM Cloud Pak for Security (CP4S) 1.10.0.0 79and 1.10.2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arCVE-2022-367776.5IBM Cloud Pak for Security (CP4S) 1.10.0.0 through 1.10.11.0 and IBM QRadar Suite Software 1.10.12.0 through 1.10.16.0could allow an authentCVE-2022-367785.4insert HTML / js code inside input how to get to the vulnerable input : Workers &gt; worker nickname &gt; inject in this input the code.CVE-2022-367799.8PROSCEND - PROSCEND / ADVICE .Ltd - G/5G Industrial Cellular Router (with GPS)4 Unauthenticated OS Command Injection Proscend M330-w / M33-W
CVE-2022-36765: High severity, CVSS 7.8 | Vulnix