EDK II PXE boot flaw can run code before the OS loads (CVE-2026-97631)
Original title: Critical UEFI Firmware Flaw Allows Attackers to Execute Malicious Code Before OS Boots
Oversized ICMP errors can corrupt firmware memory only while a machine is PXE-booting; TianoCore merged a fix on October 15.
A critical flaw in EDK II’s PXE Base Code driver, CVE-2026-97631, mishandles ICMP error copies during IPv4 and IPv6 network boot. Messages larger than the 504-byte Mode.IcmpError field can overwrite adjacent firmware memory, hanging boot or, on a known build, executing attacker-supplied instructions in the DXE phase. The advisory says EDK II master was affected as of September 14, 2026. TianoCore merged corrective changes in pull request #13302 on October 15, 2026, but device firmware availability is separate.
Unconfirmed: Whether individual device firmware builds include the October 15 upstream fix is not stated.
- The bug is in NetworkPkg/UefiPxeBcDxe handlers PxeBcIcmpErrorDpcHandle and PxeBcIcmp6ErrorDpcHandle.
- Exploitation needs an active PXE boot and a unicast ICMP error; no authentication is required.
- The merged patch truncates oversized messages and clears the ICMP error buffer before copying.
- Alex Matrosov of Anthropic and Dan Holmes-Mitra of Google are credited.
Impact: Pre-boot memory corruption, boot hang, or code execution
| Product | Affected |
|---|---|
| TianoCore EDK II | master as of September 14, 2026 |
- 1.Track whether device vendors have shipped firmware that includes pull request #13302.
- 2.Limit network exposure of hosts during PXE boot.
- CVEs
- CVE-2026-97631
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-97631 | Remote buffer overflow in EDK2 BIOS | 9.5 | <1% | PoC ×3 |
From the original article
2 min read at gbhackers.com
A critical vulnerability in EDK II’s PXE network boot driver could allow unauthenticated attackers to execute malicious code before the operating system loads. This vulnerability, tracked as CVE-2026-97631, affects ICMP error processing during both IPv4 and IPv6 network boot, which exposes the firmware memory to potential writes by attackers. The advisory identifies the EDK II […]
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.