EDK II UEFI flaw CVE-2026-97631 can run code before the OS
A 16-year-old PXE ICMP buffer overflow, rated 9.5, was disclosed early after AMI published a fix.
78
CVE-2026-97631
Remote buffer overflow in EDK2 BIOS
- CVSS 4.0
- 9.5 critical
- EPSS
- <1%p50
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
EDK2's BIOS code mishandles buffer size, allowing a classic buffer overflow and an out-of-bounds write. An unauthenticated remote attacker can trigger it without user interaction when the required attack conditions are met. Successful exploitation can run arbitrary code and affect confidentiality, integrity, and availability. Affected builds are not listed.
What to do: Apply EDK2's update for CVE-2026-97631. No fixed version or workaround is stated.
| Product | Affected |
|---|---|
| EDK2 | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality, Integrity, and Availability.
- Weakness
- CWE-120, CWE-131, CWE-787
- Vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
In the news
8 storiesEDK2 UEFI bug CVE-2026-97631 enables pre-boot code execution
A 16-year-old buffer overflow in the PXE ICMP parser scores 9.5; an early AMI patch made the bug public before the planned January disclosure.
78
CVE-2026-97631 lets attackers run code before the OS on EDK II PXE boots
An unauthenticated ICMP sender can overflow a 504-byte field during PXE boot; AMI’s fix surfaced early and affected devices remain unclear.
74
EDK II PXE boot flaw can run code before the OS loads (CVE-2026-97631)
Oversized ICMP errors can corrupt firmware memory only while a machine is PXE-booting; TianoCore merged a fix on October 15.
72
CVE-2026-97631: unauthenticated pre-boot RCE in EDK II PXE driver
An attacker on the network can execute code during IPv4 or IPv6 PXE boot via ICMP error messages, affecting UEFI firmware on many servers.
70
16-year-old EDK II PXE buffer overflow runs code before Secure Boot
CVE-2026-97631 lets an adjacent-network attacker hang or hijack network boots on servers, and no stable EDK II release ships the fix yet.
70
EDK II PXE flaw CVE-2026-97631 allows pre-boot code execution
One ICMP error during network boot can crash the client or, on a known build, run code before Secure Boot; vendor updates are still pending.
66
Roundup: UEFI boot flaw, Anthropic access dispute, Cloudflare AI leak
The digest also covers suspected freezer tampering, an FEC filing outage, and breaches at Copenhagen and ENGIE.
62