CVE-2024-38797

MediumCVSS 4.6/10Last modified Jun 17, 2026

Description

EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availability.

Metrics

CVSS 3.1 4.6/10CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Weakness enumeration

CWE-125

Affected software

VendorProductVersions
TianoCoreEDK2<= edk2-stable202408

References

Timeline

Published
Apr 7, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-387985.8EDK2 contains a vulnerability in BIOS where an attacker may cause “Exposure of Sensitive Information to an Unauthorized Actor” by local acceCVE-2024-38808.8A vulnerability has been found in Tenda W30E 1.0.1.25(633) and classified as critical. This vulnerability affects the function formWriteFacMCVE-2024-388056.3EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation oCVE-2024-388063.9Failure to properly synchronize user's permissions in UAA in Cloud Foundry Foundation v40.17.0 https://github.com/cloudfoundry/cf-deploymenCVE-2024-388076.3Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of nesteCVE-2024-388084.3In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring CVE-2024-388095.3Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack. Users of affected versions sCVE-2024-38818.8A vulnerability was found in Tenda W30E 1.0.1.25(633) and classified as critical. This issue affects the function frmL7PlotForm of the file CVE-2024-388107.5Missing Authorization When Using @AuthorizeReturnObject in Spring Security 6.3.0 and 6.3.1 allows attacker to render security annotations inCVE-2024-388117.8VMware Fusion (13.x before 13.6) contains a code-execution vulnerability due to the usage of an insecure environment variable. A malicious aCVE-2024-388129.8The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network accesCVE-2024-388139.8The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this v
CVE-2024-38797: Medium severity, CVSS 4.6 | Vulnix