CVE-2024-38798

MediumCVSS 5.8/10Last modified Oct 2, 2026

Description

EDK2 contains a vulnerability in BIOS where an attacker may cause “Exposure of Sensitive Information to an Unauthorized Actor” by local access. Successful exploitation of this vulnerability will lead to

possible information disclosure or escalation of privilege

and impact Confidentiality.

Metrics

CVSS 4.0 5.8/10

CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-200

Affected software

No affected versions have been published.

Timeline

Published: Dec 9, 2025
Last modified: Oct 2, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-38808.8A vulnerability has been found in Tenda W30E 1.0.1.25(633) and classified as critical. This vulnerability affects the function formWriteFacM CVE-2024-388056.3EDK2 contains a vulnerability in BIOS where a user may cause an Integer Overflow or Wraparound by network means. A successful exploitation o CVE-2024-388063.9Failure to properly synchronize user's permissions in UAA in Cloud Foundry Foundation v40.17.0 https://github.com/cloudfoundry/cf-deploymen CVE-2024-388076.3Applications that use spring-boot-loader or spring-boot-loader-classic and contain custom code that performs signature verification of neste CVE-2024-388084.3In Spring Framework versions 5.3.0 - 5.3.38 and older unsupported versions, it is possible for a user to provide a specially crafted Spring CVE-2024-388095.3Applications that parse ETags from "If-Match" or "If-None-Match" request headers are vulnerable to DoS attack. Users of affected versions s CVE-2024-38818.8A vulnerability was found in Tenda W30E 1.0.1.25(633) and classified as critical. This issue affects the function frmL7PlotForm of the file CVE-2024-388107.5Missing Authorization When Using @AuthorizeReturnObject in Spring Security 6.3.0 and 6.3.1 allows attacker to render security annotations in CVE-2024-388117.8VMware Fusion (13.x before 13.6) contains a code-execution vulnerability due to the usage of an insecure environment variable. A malicious a CVE-2024-388129.8The vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network acces CVE-2024-388139.8The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this v CVE-2024-388148.8An authenticated SQL injection vulnerability in VMware HCX was privately reported to VMware. A malicious authenticated user with non-admini