CVE-2017-5733
edk2: Privilege escalation via heap-based buffer overflow in MakeTable() function
Severity
ModerateRed Hat Product Security
CVSS 3.0
Review impact separately from score.
Published · October 16, 2018
Updated · November 21, 2025
Description
[REJECTED CVE] A heap-based buffer overflow vulnerability exists in EDK II within the MakeTable() function of BaseUefiDecompressLib.c, TianoCompress.c, and the UEFI specification. An authenticated attacker could exploit this flaw by supplying a crafted file, potentially leading to privilege escalation.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.0 · 6.7CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE-287 · Improper Authentication