CVE-2021-38576: Tianocore EDK2

High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days.

A BIOS bug in firmware for a particular PC model leaves the Platform authorization value empty. This can be used to permanently brick the TPM in multiple ways, as well as to non-permanently DoS the system.

Affected products

• Tianocore EDK2: version 201808 only; version 201811 only; version 201903 only; version 201905 only; version 201908 only; version 201911 only; …

Published 2022-01-03. Last modified 2026-06-17.