EDK II UEFI flaw CVE-2026-97631 can run code before the OS
Original title: Most Servers on the Planet Are Vulnerable to This Firmware Code-Execution Flaw
A 16-year-old PXE ICMP buffer overflow, rated 9.5, was disclosed early after AMI published a fix.
CVE-2026-97631 is a memory-corruption bug in the TianoCore EDK II PXE Base Code driver’s ICMP handling, used in UEFI firmware by server and cloud vendors. A malicious ICMP error sent to a device’s IP during network boot can overflow a 504-byte field and, when the firmware build is known, execute code in ring 0 before Secure Boot defenses apply. One-time payloads do not persist, but they can help install other early-boot code. AMI published a fix in a pull request ahead of a planned January disclosure, and TianoCore then issued a public advisory.
Unconfirmed: The article does not report confirmed attacks; researchers say public patch code will make exploits easy to build.
- The bug is in NetworkPkg/UefiPxeBcDxe for both IPv4 and IPv6 handlers.
- AMI, Insyde, Phoenix and Microsoft’s Project Mu use the affected EDK II code.
- An oversized ICMP message can also hang the boot sequence.
- Alex Matrosov of Anthropic and Dan Holmes of Google found the flaw.
Impact: Pre-OS code execution during PXE boot, before Secure Boot
| Product | Affected |
|---|---|
| TianoCore EDK II | — |
| AMI UEFI firmware based on EDK II | — |
| Insyde UEFI firmware based on EDK II | — |
| Phoenix UEFI firmware based on EDK II | — |
| Microsoft Project Mu | — |
- 1.Apply vendor UEFI firmware updates that include the published EDK II fix.
- CVEs
- CVE-2026-97631
- ATT&CK
- T1542 Pre-OS Boot
- Products
- EDK IIProject Mu
- Organizations
- AnthropicGoogleUEFI Forum
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-97631 | Remote buffer overflow in EDK2 BIOS | 9.5 | <1% | PoC ×3 |
From the original article
7 min read at wired.com
The critical flaw in UEFI firmware—used by most server vendors and data centers—allows attackers to execute code early in the boot process.
By Dan Goodin, Ars Technica · wired.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.