Back to Database
Status published
Medium
CVE-2024-38798
Uncleared password keystrokes in circular queue can lead to information disclosure or escalation of privilege
Vulnerability Description
EDK2 contains a vulnerability in BIOS where an attacker may cause “Exposure of Sensitive Information to an Unauthorized Actor” by local access. Successful exploitation of this vulnerability will lead to possible information disclosure or escalation of privilege and impact Confidentiality.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-38798
Credits & Attribution
No credits recorded in the NVD database.
More from TianoCore
View All →CVE-2025-3770
SMM IDT Privilege Escalation Vulnerability
High
7
CVE-2025-2296
Un-verified kernel bypass Secure Boot mechanism in direct boot mode
High
8.4
CVE-2025-2295
Potential iSCSI R2T PDU Vulnerability
Low
3.5
CVE-2024-38805
iSCSI Remote Memory Corruption and Denial of Service
Medium
6.3
CVE-2024-38797
Out-of-bounds Read in HashPeImageByType()
Medium
4.6
Affected Vendor
TianoCore
View all reports →Affected Software
EDK2
Vulnerable Versions:
0
Timeline
Official Publish:
December 9th, 2025
Last Modified:
December 9th, 2025
Added to House:
July 22nd, 2026