Vulnerability in TianoCore EDK2

[ Description ]Official description

EDK2 contains a vulnerability in the HashPeImageByType(). A user may cause a read out of bounds when a corrupted data pointer and length are sent via an adjecent network. A successful exploit of this vulnerability may lead to a loss of Integrity and/or Availability.

[ Fixes ]Fixes and patches

• Security bulletin: Citrix CTX697256Vendor patch or bulletin · CERT-FR · support.citrix.com/support-home/kbsearch/article, cited by CERT-FR CERTFR-2026-AVI-1449
• Security bulletin: Citrix CTX697300Vendor patch or bulletin · CERT-FR · support.citrix.com/support-home/kbsearch/article, cited by CERT-FR CERTFR-2026-AVI-1449

[ Advisories ]Government CERT advisories

• CERT-FR4 Nov 2026CERTFR-2026-AVI-1449

  Multiple vulnerabilities in Citrix products Translated from French

  Multiple vulnerabilities have been discovered in Citrix products. They allow an attacker to cause remote arbitrary code execution and privilege escalation.

  CVE-2022-36763CVE-2026-98432CVE-2022-36764+6 more CVEs

[ References ]References

• github.com/tianocore/edk2/security/advisories/GHSA-4wjw-6xmf-44xf