CVE-2026-97631 lets attackers run code before the OS on EDK II PXE boots
Original title: CVE-2026-97631: 16-Year-Old UEFI Flaw Threatens Servers
An unauthenticated ICMP sender can overflow a 504-byte field during PXE boot; AMI’s fix surfaced early and affected devices remain unclear.
A buffer overflow tracked as CVE-2026-97631 (CVSS 9.5) in TianoCore EDK II’s PXE-Base Code driver can corrupt DXE-phase memory when a machine is network-booting. An attacker who can deliver ICMP error messages may run code before the operating system, Secure Boot, or measured boot. AMI published a fix last month, ahead of a planned January disclosure, and TianoCore then warned publicly. There is no evidence the bug yields initial access from outside a network, and disk-only boots are not affected.
Unconfirmed: Which devices include the vulnerable EDK II PXE code is still unclear, and several vendors had not responded.
- The bug is in NetworkPkg/UefiPxeBcDxe and mishandles both IPv4 and IPv6 ICMP errors.
- Oversized messages write past Mode.IcmpError because the copy ignores the 504-byte limit.
- EDK II is used by AMI, Insyde, Phoenix, and Microsoft’s Project Mu.
- Intel and Arm say their own products are not directly affected.
- Firmware suppliers should be contacted, and network boot disabled where possible.
Impact: Pre-OS arbitrary code execution during PXE boot
| Product | Affected |
|---|---|
| TianoCore EDK II | — |
- 1.Contact the system or firmware supplier and obtain a firmware update.
- 2.Disable network boot where it is not required.
- 3.Monitor logs for suspicious activity during PXE boot.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-97631 | Remote buffer overflow in EDK2 BIOS | 9.5 | <1% | PoC ×3 |
From the original article
3 min read at securityaffairs.com
CVE-2026-97631: A 16-year-old UEFI flaw (CVSS score of 9. 5/10) enables pre-OS code execution. Exposed servers need firmware patches and checks.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.