Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilitycritical

16-year UEFI PXE flaw still unfixed in stable EDK II

8 sources · 10 articlesFirst reported Updated ()1
What's new

No report after October 28 adds new facts about CVE-2026-97631.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

CVE-2026-97631 remains unfixed in stable EDK II and most OEM firmware after early disclosure of a pre-boot PXE overflow.

CVE-2026-97631 (CVSS 9.5) is a buffer overflow in TianoCore EDK II’s PXE driver, NetworkPkg/UefiPxeBcDxe, present since November 2010 and used by AMI, Insyde, Phoenix, Microsoft Project Mu, and much server UEFI firmware. During PXE boot, an unauthenticated attacker who can deliver an oversized unicast ICMP error can write past a 504-byte field, hanging the DXE phase or, with a build-specific exploit, running code before Secure Boot. TianoCore advisory GHSA-99cj-7hg9-mp4m appeared October 22 after an early AMI fix broke a planned January disclosure; a fix was merged October 15, but no stable EDK II release includes it, leaving Red Hat, SUSE, and Debian packages unfixed. The Hacker News calls the attacker adjacent-network; Cyber Security News says the sender can be anywhere on the network; Security Affairs reports no evidence of access from outside a network. Intel and Arm say their own products are not directly affected.

Key facts
  • Overflow writes past the 504-byte Mode.IcmpError field in IPv4 and IPv6 handlers.
  • EDK II master was affected as of September 14, 2026.
  • Pull request 13302 merged October 15; the public advisory followed October 22.
  • No stable EDK II release contains the fix; RHEL 8, 9, and 10 remain unfixed.
  • The Hacker News says Project Mu tagged fixed builds on October 26.
  • One-time payloads are not persistent but can install other early-boot code.
Analyze CVE-2026-97631 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Sep 14, 2026EDK II master confirmed affected by the PXE bug · Cyber Security News
  2. Oct 15, 2026Maintainers merged corrective pull request 13302 · GBHackers
  3. Oct 22, 2026TianoCore published the public security advisory · The Hacker News
  4. Oct 26, 2026Project Mu tagged builds containing the fix · The Hacker News

What each outlet adds

beyond the shared facts
  • Ars TechnicaAMI’s early patch exposed the bug before January disclosure.
  • Cyber Security NewsA maintainer said opening the public pull request broke the embargo.
  • GBHackersNames both ICMP handlers and says the patch truncates and clears.
  • Security AffairsReports no evidence the bug yields access from outside a network.
  • The Hacker NewsFix is only on the main branch; RHEL 8, 9, and 10 unfixed.
CVEs
CVE-2026-97631CVE-2026-98432
Vendors
TianoCoreAMIInsydePhoenixMicrosoftUbuntuRed HatAmazonOracleSUSEDebianTianoCore (EDK II)
Products
EDK IIProject MuLinux kernelRed Hat Enterprise LinuxAmazon LinuxOracle Linuxedk2UefiPxeBcDxe
Organizations
AnthropicGoogleUEFI ForumDragosEclypsiumDebianUbuntu
AI models
Claude

Coverage

oldest first · one row per article · UTC
  1. · 2d ago Ars Technica · SecurityFirst report

    EDK2 UEFI bug CVE-2026-97631 enables pre-boot code execution

    A 16-year-old buffer overflow in the PXE ICMP parser scores 9.5; an early AMI patch made the bug public before the planned January disclosure.

  2. · 2d ago Cyber Security News

    EDK II PXE flaw CVE-2026-97631 allows pre-boot code execution

    One ICMP error during network boot can crash the client or, on a known build, run code before Secure Boot; vendor updates are still pending.

  3. · 2d ago GBHackers

    EDK II PXE boot flaw can run code before the OS loads (CVE-2026-97631)

    Oversized ICMP errors can corrupt firmware memory only while a machine is PXE-booting; TianoCore merged a fix on October 15.

  4. · 2d ago Security Affairs

    CVE-2026-97631 lets attackers run code before the OS on EDK II PXE boots

    An unauthenticated ICMP sender can overflow a 504-byte field during PXE boot; AMI’s fix surfaced early and affected devices remain unclear.

  5. · 2d ago The Hacker News

    16-year-old EDK II PXE buffer overflow runs code before Secure Boot

    CVE-2026-97631 lets an adjacent-network attacker hang or hijack network boots on servers, and no stable EDK II release ships the fix yet.

  6. · 2d ago oss-security

    CVE-2026-97631: unauthenticated pre-boot RCE in EDK II PXE driver

    An attacker on the network can execute code during IPv4 or IPv6 PXE boot via ICMP error messages, affecting UEFI firmware on many servers.

  7. · 1d ago WIRED · Security

    EDK II UEFI flaw CVE-2026-97631 can run code before the OS

    A 16-year-old PXE ICMP buffer overflow, rated 9.5, was disclosed early after AMI published a fix.

  8. · 1d ago The Hacker News

    Linux TCP use-after-free scored 9.8; Ubuntu and RHEL unfixed

    Anthropic says Claude built a remote root exploit via MPTCP, a link absent from the CVE and fix.

  9. · 17h ago Hacker News · security

    Linux TCP use-after-free CVE-2026-98432 yields lab remote root

    Upstream CVSS is 9.8 and Red Hat scores 5.9; Anthropic’s root chain used a lab Multipath TCP listener.

  10. · 12h ago GBHackers

    Linux kernel TCP use-after-free CVE-2026-98432 can crash Ubuntu

    Ubuntu lists kernels through 22.04 LTS as affected, with fixes still in progress and no confirmed exploitation.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-97631
Remote buffer overflow in EDK2 BIOS
9.5<1%PoC ×3
CVE-2026-98432
Use-after-free in Linux kernel IPv4 TCP options
9.8<1%PoC ×15