CVE-2025-2486 - CVE House
Back to Database
Status published Low CVE-2025-2486

UEFI Shell accessible in AAVMF with Secure Boot enabled on Ubuntu

Vulnerability Description

The Ubuntu edk2 UEFI firmware packages accidentally allowed the UEFI Shell to be accessed in Secure Boot environments, possibly allowing bypass of Secure Boot constraints. Versions 2024.05-2ubuntu0.3 and 2024.02-2ubuntu0.3 disable the Shell. Some previous versions inserted a secure-boot-based decision to continue running inside the Shell itself, which is believed to be sufficient to enforce Secure Boot restrictions. This is an additional repair on top of the incomplete fix for CVE-2023-48733.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-2486

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Dann Frazier

References

More from Ubuntu

View All →
CVE-2025-7044
Privilege Escalation in MAAS via Websocket Request Manipulation
High 7.7
CVE-2023-0881
DDoS in Ubuntu package linux-bluefield
High 7.5
CVE-2022-1804
Accountsservice incorrectly drops privileges
Medium 5.5
CVE-2021-3939
Free of static data in accountsservice
High 7.8
CVE-2021-3493
The overlayfs implementation in the linux kernel did not properly...
High 8.8

Affected Vendor

Affected Software

edk2
Vulnerable Versions:
2024.05, 2024.02

Timeline

Official Publish: November 26th, 2025
Last Modified: November 26th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-489

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.