CVE-2023-45230 is a high severity buffer overflow, scored 8.3, in the EDK2 network package. A long server ID option in a DHCPv6 message overflows the client. The fix is in edk2-stable202402, so update firmware or disable PXE boot where you can.
What's affected
The advisory for the EDK2 network stack (tracked as GHSA-hc6x-cw6p-gj7h) lists NetworkPkg in EDK2 up to and including the 202311 release as affected. The NVD record shows the product as TianoCore EDK2 with no version bounds, so the advisory is the more precise source.
The advisory lists these releases as fixed:
- CVE-2023-45229 through CVE-2023-45235 are fixed in edk2-stable202402.
- CVE-2023-45236 and CVE-2023-45237 are fixed in edk2-stable202405.
EDK2 is the open source UEFI firmware reference code. Many vendors build their own firmware from it, so the version you need to look at is your firmware vendor's release, not the EDK2 tag. Virtual machine firmware such as OVMF is built from the same code.
How to check if you're exposed
You need to know two things: whether your machines run an EDK2 based firmware, and whether network boot is enabled on them.
On a Linux host you can read the firmware vendor and version from the DMI tables:
sudo dmidecode -t bios
For virtual machines that use OVMF, check the packaged firmware build on the hypervisor host:
dpkg -l | grep -i ovmf
rpm -q edk2-ovmf
Compare the result with your vendor's advisory, since vendors backport fixes under their own version numbers. Then look in firmware setup, or in your fleet tooling, for PXE or HTTP boot settings. The advisory states that exploitation needs PXE boot enabled, that it is off by default, and that it is often turned on for servers and some laptops.
What to do now
- List the systems whose firmware is built from EDK2, including virtual machines that use OVMF, and record the firmware version of each.
- Apply firmware updates that include EDK2 stable 202402 or later, using your hardware vendor's release notes to confirm the fix is present.
- If you cannot update yet, turn off PXE and HTTP boot on machines that do not need network boot, as the advisory suggests.
- Keep firmware update status in the same inventory as your software dependencies, so a future firmware advisory is a query and not a project.
Why it matters
The weakness is a buffer overflow, filed under CWE-119. The EDK2 DHCPv6 client copies a server ID option into a buffer without enough regard for its length, so a long option can write past the end. The record's description says this could cost confidentiality, integrity and availability.
The vector is CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:H. The access vector is adjacent, meaning the attacker needs to be on the same network segment as the booting machine. That narrows the risk to places where untrusted devices share a network with hosts doing network boot, such as shared lab or colocation networks.
The CVE is not on the CISA Known Exploited Vulnerabilities list and the advisory does not say it is exploited. Firmware runs before the operating system, so a flaw at this level is harder to detect and slower to patch than an application bug. That is the reason to keep a firmware inventory.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan reads the manifests and lockfiles of software projects. It will not see firmware or device images, so for this issue the asset inventory and the vendor advisory are your main tools.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to patch if PXE boot is off?
The advisory says exploitation requires PXE boot to be enabled, so turning it off reduces exposure. Updating firmware is still the real fix.
Which release fixes this CVE?
Per the GitHub advisory, edk2-stable202402 includes the fix. Vendors may ship it under their own version numbers.
Sources
Last reviewed: 19 October 2026.
