CVE-2023-45232 - CVE House
Back to Database
Status published High CVE-2023-45232

Infinite loop in EDK II Network Package

Vulnerability Description

EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in the Destination Options header of IPv6. This vulnerability can be exploited by an attacker to gain unauthorized access and potentially lead to a loss of Availability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-45232

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Quarkslab Vulnerability Reports Team
  • Doug Flick

References

More from TianoCore

View All →
CVE-2025-3770
SMM IDT Privilege Escalation Vulnerability
High 7
CVE-2025-2296
Un-verified kernel bypass Secure Boot mechanism in direct boot mode
High 8.4
CVE-2025-2295
Potential iSCSI R2T PDU Vulnerability
Low 3.5
CVE-2024-38805
iSCSI Remote Memory Corruption and Denial of Service
Medium 6.3
CVE-2024-38798
Uncleared password keystrokes in circular queue can lead to information disclosure or escalation of privilege
Medium 5.8

Affected Vendor

Affected Software

edk2
Vulnerable Versions:
edk2-stable202308

Timeline

Official Publish: January 16th, 2024
Last Modified: November 4th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-835

MITRE ATT&CK TTPs

T1499 Endpoint Denial of Service
Impact
T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1562 Impair Defenses
Defense Evasion
T1485 Data Destruction
Impact