AIKIDO-2026-940736
edk2-ovmf is vulnerable to Out-of-bounds Write
98
CVE Score
Critical
Out-of-bounds Write
TL;DR
edk2 vendors Google's Brotli decoder and uses it to decompress Brotli-compressed firmware sections. A block type switch in a stream that declares only one block type is ignored on the fast path, so decoding continues and writes outside the decoder output buffer. A crafted firmware volume can crash the boot path, disclose memory, corrupt data, or potentially execute arbitrary code. No published stable tag vendors a decoder that reports the invalid block switch and stops.
How do I fix this?
No patched release is currently available. Stop decoding untrusted Brotli-compressed firmware sections with edk2-ovmf until a fixed release is published.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and firmware decompression uses the bundled Brotli decoder.
Package
edk2-ovmfVersions
202005 - 202608
No fix availableBackground info
edk2-ovmf is vulnerable to Out-of-bounds Write in versions 202005 - 202608.
Links
CVE Detail
GitHub Releases
github.com/andybalholm/brotli/releases/tag/v1.2.7github.com/google/brotli/releases/tag/v1.0.10github.com/google/brotli/releases/tag/v1.1.1github.com/google/brotli/releases/tag/v1.2.1Related Issues
Other
nodejs.org/en/blog/vulnerability/october-2026-security-releases#nodejs-brotli-decoder-out-of-bounds-write-permits-remote-code-execution-cve-2026-111497---highopenwall.com/lists/oss-security/2026/10/23/25openwall.com/lists/oss-security/2026/10/24/6openwall.com/lists/oss-security/2026/10/26/12openwall.com/lists/oss-security/2026/10/26/13openwall.com/lists/oss-security/2026/10/26/16openwall.com/lists/oss-security/2026/11/03/2broccoli2shell.comlists.debian.org/debian-lts-announce/2026/10/msg00049.htmlpatchtheplanet.org/brotliaikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-111497cert-portal.siemens.com/productcert/html/ssa-045512.htmlcert-portal.siemens.com/productcert/html/ssa-443410.htmlcert-portal.siemens.com/productcert/html/ssa-898633.htmlellio.tech/en/blog/node2shell-cve-2026-111497-rce-on-stock-nodejs-builds/cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111497
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.