CVE-2026-97631: unauthenticated pre-boot RCE in EDK II PXE driver
Original title: CVE-2026-97631: Pre-boot RCE in EDK II PXE driver
An attacker on the network can execute code during IPv4 or IPv6 PXE boot via ICMP error messages, affecting UEFI firmware on many servers.
Valtteri Vuorikoski forwarded the EDK II advisory for CVE-2026-97631 to oss-security after Ars Technica reported on the flaw. While a machine is PXE-booting over IPv4 or IPv6, an unauthenticated network attacker who can deliver ICMP error messages can gain pre-boot code execution. The issue affects the EDK II UEFI PXE driver, which is widely used in server firmware.
Unconfirmed: The snippet is cut off; fixed versions and full exploitation conditions are not stated.
- Disclosed via the edk2 GitHub security advisory GHSA-99cj-7hg9-mp4m.
- Ars Technica reported the flaw affects most servers.
- Exploitation requires an attacker able to deliver ICMP errors during PXE boot.
- No fixed versions or exploitation details are given in the snippet.
Impact: unauthenticated remote code execution before the operating system boots
| Product | Affected |
|---|---|
| TianoCore (EDK II) EDK II PXE driver | — |
- 1.Check whether server firmware embeds the EDK II PXE driver
- 2.Restrict PXE boot use on untrusted networks
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-97631 | Remote buffer overflow in EDK2 BIOS | 9.5 | <1% | PoC ×3 |
From the original article
Posted by Valtteri Vuorikoski on Oct 28 Ars Technica reported on this yesterday https://arstechnica. com/security/2026/10/code-execution-flaw-in-uefi-firmware-threatens-most-servers-on-planet-earth/> https://github. com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m> on the edk2 repo: Summary While a machine is PXE-booting over IPv4 or IPv6, an unauthenticated network attacker who can deliver ICMP error...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.