EDK2 UEFI bug CVE-2026-97631 enables pre-boot code execution
Original title: Code-execution flaw in UEFI firmware threatens most servers on planet Earth
A 16-year-old buffer overflow in the PXE ICMP parser scores 9.5; an early AMI patch made the bug public before the planned January disclosure.
CVE-2026-97631 is a memory-corruption flaw in TianoCore EDK II, reference code used by AMI, Insyde, Phoenix, Microsoft Project Mu and most server UEFI firmware. During PXE boot, oversized ICMP errors can write past a 504-byte field and run attacker code in ring 0 before Secure Boot. Payloads are not persistent but can install other early-boot code. AMI published a fix early, and TianoCore then issued a public advisory.
Unconfirmed: The article says exploits will be easy to build from the public patch, but it does not report attacks.
- The flaw is in NetworkPkg/UefiPxeBcDxe handlers for IPv4 and IPv6 ICMP errors.
- A unicast ICMP error during PXE boot can hang boot or run code when the firmware build is known.
- Alex Matrosov of Anthropic and Dan Holmes of Google found it; disclosure was set for January.
- Firmware updates across many hardware makers and cloud providers will be slow.
Impact: pre-OS ring-0 code execution during PXE boot
| Product | Affected |
|---|---|
| TianoCore EDK II | — |
- 1.Track vendor UEFI firmware updates that include the published EDK2 fix.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-97631 | Remote buffer overflow in EDK2 BIOS | 9.5 | <1% | PoC ×3 |
From the original article
7 min read at arstechnica.com
Critical flaw in EDK2 allows attackers to execute code early in the boot process.
By Dan Goodin · arstechnica.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.