EDK II PXE flaw CVE-2026-97631 allows pre-boot code execution
Original title: Critical UEFI Firmware Flaw Could Expose Millions of Servers to Pre-Boot Code Execution
One ICMP error during network boot can crash the client or, on a known build, run code before Secure Boot; vendor updates are still pending.
A bug in the EDK II PXE driver, CVE-2026-97631 (CVSS v4 9.5), lets a remote attacker send an oversized ICMP error while a machine is network-booting and write past a 504-byte field. The packet can hang the DXE core or, if the attacker knows the firmware build, execute code before Secure Boot. Maintainers merged pull request 13302 on October 15, 2026, but the advisory still lists the issue as unpatched because vendors must ship firmware. A maintainer said the embargo was broken when the pull request was opened publicly.
Unconfirmed: The advisory still says the flaw is not patched even though the code fix is merged, and no in-the-wild exploitation is reported.
- The bug is in NetworkPkg on EDK II master as of September 14, 2026.
- UefiPxeBcDxe mishandles ICMP length in both IPv4 and IPv6 handlers.
- No login or user action is required, and the sender can be anywhere on the network.
- Alex Matrosov of Anthropic and Dan Holmes-Mitra of Google are credited.
- The October 15 merge came before the advisory appeared on October 22.
Impact: Pre-boot code execution or a hung PXE boot
| Product | Affected |
|---|---|
| TianoCore EDK II | NetworkPkg in master as of September 14, 2026 |
- 1.Ask firmware vendors when they will ship an update containing pull request 13302.
- 2.Keep PXE traffic on isolated networks and block unexpected ICMP errors to booting machines.
- 3.Turn off PXE on systems that do not need network boot.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-97631 | Remote buffer overflow in EDK2 BIOS | 9.5 | <1% | PoC ×3 |
From the original article
4 min read at cybersecuritynews.com
A critical bug in open-source EDK II firmware lets a remote attacker run code on a machine before the operating system starts. The flaw is tracked as CVE-2026-97631. It sits in the network boot (PXE) driver and received a CVSS v4 score of 9.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.