Infinite loop in EDK II Network Package
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.5epss 2.1%
exploitation probability
2.1%top 20% of all CVEs
observed exploitation
nono source reports it
EDK2's Network Package is susceptible to an infinite loop vulnerability when parsing unknown options in the Destination Options header of IPv6. This
vulnerability can be exploited by an attacker to gain unauthorized
access and potentially lead to a loss of Availability.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
TianoCore · edk2References
http://packetstormsecurity.com/files/176574/PixieFail-Proof-Of-Concepts.htmlhttps://github.com/tianocore/edk2/security/advisories/GHSA-hc6x-cw6p-gj7hhttps://lists.debian.org/debian-lts-announce/2025/06/msg00007.htmlhttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SJ42V7O7F4OU6R7QSQQECLB6LDHKZIMQ/https://security.netapp.com/advisory/ntap-20240307-0011/https://www.kb.cert.org/vuls/id/132380http://www.openwall.com/lists/oss-security/2024/01/16/2