The vulnerability in EDK II firmware involves an out‑of‑bounds write and a classic buffer overflow caused by an inaccurate calculation of buffer size. An attacker who can send crafted data during a PXE boot process could trigger these memory corruption errors, resulting in arbitrary code execution on the target machine and affecting confidentiality, integrity, and availability.

The flaw is present in TianoCore EDK II, a widely used UEFI firmware implementation. No specific version range is listed in the advisory, so all builds that include the vulnerable PXE driver should be considered at risk until a fix is applied.

The CVSS score of 9.5 marks this flaw as critical. The EPSS score is not available, so the exact likelihood of exploitation is unknown, but the absence of a KEV listing does not diminish the severity. Remote attackers can potentially reach the vulnerable code through a PXE boot request, a common pre‑boot network boot scenario, making exploitation plausible if the firmware is not updated.