16-year-old EDK II PXE buffer overflow runs code before Secure Boot
Original title: Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers
CVE-2026-97631 lets an adjacent-network attacker hang or hijack network boots on servers, and no stable EDK II release ships the fix yet.
A critical buffer overflow in EDK II's PXE network-boot code, present since November 2010, allows an adjacent-network attacker to crash a boot or run build-specific code before Secure Boot loads. TianoCore rated CVE-2026-97631 at 9.5 and published an advisory on October 22; a fix exists in the main development branch but no stable release contains it, leaving RHEL, SUSE and Debian packages unfixed. Intel and Arm say their products are not known to be affected, while the status of most OEM firmware is unclear. Operators who do not need PXE can disable it to reduce exposure.
Unconfirmed: How many shipping products carry the vulnerable code is unknown, and several vendors did not respond to questions.
- The flawed copy loop was added in November 2010.
- The advisory lists no patched version; the fix is only in the main development branch.
- Red Hat lists its edk2 package in RHEL 8, 9 and 10 as affected and unfixed.
- Code execution requires an exploit tailored to the exact firmware build.
- Microsoft's Project Mu cut tagged builds containing the fix on October 26.
Impact: attacker code execution in firmware before Secure Boot, or a hung boot
| Product | Affected | Fixed in |
|---|---|---|
| TianoCore EDK II | up to and including edk2-stable202608 | fix merged in main branch October 15; no stable release |
| Red Hat edk2 | Red Hat Enterprise Linux 8, 9 and 10 | — |
- 1.Disable PXE network boot where it is not needed
- 2.Watch boot-time network traffic and logs for crafted ICMP and status messages
- 3.Track vendor firmware updates built from the October 15 fix
- CVEs
- CVE-2026-97631
- Products
- EDK IIProject Muedk2
- Organizations
- Eclypsium
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-97631 | Remote buffer overflow in EDK2 BIOS | 9.5 | <1% | PoC ×3 |
From the original article
6 min read at thehackernews.com
A critical 16-year-old flaw in EDK II, the open-source code that most hardware makers use to build UEFI firmware, can allow an attacker to run code on a machine before its operating system loads, but only while the machine is booting over the network. UEFI firmware is the software that runs first when a computer is switched on, before the operating system. An attacker who can reach the machine
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.