TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A memory-corruption flaw in TianoCore EDK II can let an attacker execute code in UEFI firmware during PXE network boot, before operating-system defenses start. The vulnerability, CVE-2026-97631, has a reported severity score of 9.5 out of 10; public patch details appeared ahead of the planned coordinated disclosure, while affected products and remediation timelines remain unclear.
A memory-corruption vulnerability in TianoCore EDK II can allow an attacker to execute code in a device’s UEFI firmware during network boot, before the operating system and protections such as Secure Boot take over. Tracked as CVE-2026-97631 and rated 9.5 out of 10 in the report, the flaw affects widely reused firmware code, but the full list of affected products and the time needed to patch them are not yet clear.
The flaw is in EDK2’s PXE Base Code driver, which supports booting a device from code supplied over a local network. During PXE boot, the driver listens for ICMP error messages. According to the project advisory, its IPv4 and IPv6 handlers copy incoming data into a fixed 504-byte field without correctly limiting the copy. A sufficiently long message can write beyond that field and corrupt adjacent memory.
The report says an attacker can send a unicast message to a device’s IP address while it is in the PXE boot sequence. Depending on the target and the attacker’s knowledge of its firmware build, the result may be a boot failure or attacker-controlled code execution in the UEFI environment, at the CPU’s highly privileged ring 0. That execution occurs before the operating system can apply its usual defenses. The report says the initial payload does not persist on its own, although an attacker could use the access to try to install a separate persistent component.
The exposure is difficult to assess from the shared code alone. Ars Technica reports that EDK2 is used extensively by UEFI suppliers including AMI, Insyde and Phoenix, and that Microsoft’s Project Mu fork also used the component. Those relationships do not establish that every product from those vendors is affected: implementation choices, firmware versions and whether PXE boot is enabled can differ. The reported severity score is not a count of vulnerable servers.
Risks Before Secure Boot Starts
The concern is the point in the startup process where the bug runs. UEFI firmware executes before the operating system, so a successful exploit could operate outside many controls defenders rely on after startup. The report says this position may give an attacker access to sensitive components, including the Trusted Platform Module, and could undermine confidence in boot-time integrity checks and remote attestation.
HD Moore, chief research officer at Dragos and creator of Metasploit, told Ars Technica that an attacker could use the flaw to hijack program flow while the boot process still has access to sensitive components. He said this might help break disk encryption in cases involving temporary network access, and could be easier if a device is stolen. These are potential consequences described by Moore, not evidence that the vulnerability has been exploited in the wild.
Remediation is also more complicated than updating a single centrally managed application. EDK2 is incorporated into firmware distributed by multiple hardware makers and cloud providers, so fixes must reach particular product models through their respective vendors. Organizations may need to identify which machines use affected firmware, determine whether they boot from a network, and apply vendor updates. The report does not provide a confirmed global count of affected devices.
Products Worth Considering
Ring Floodlight Cam 2K Wired Security Camera, 3-Pack, Black
Philips Hue Secure Wired Video Doorbell, 2K, Black
Ring Floodlight Cam Wired Plus, 1080p HD Outdoor Security Camera with Motion-Activated Floodlights, 4-Pack, White
As an affiliate, we earn on qualifying purchases.
How the Disclosure Unfolded
The vulnerability was discovered by Alex Matrosov of Anthropic and Dan Holmes of Google, according to the report. The researchers had arranged for the issue to remain private until a coordinated disclosure planned for January. That plan was disrupted after AMI published a pull request the previous month that described the vulnerability and included a code fix. TianoCore project members then posted a public advisory last week.
Ars Technica reports that the public patch code may make it easier for technically capable attackers to understand the defect and develop an exploit. That is a risk assessment, not confirmation that a working exploit has been observed. The issue is described as a 16-year-old buffer overflow in the PXE driver. Its age does not establish how long any particular product has been vulnerable, since products may use different code versions or configurations.
The flaw joins a history of vulnerabilities involving UEFI and related components. The report cites PixieFail, which also involved EDK2 PXE boot code, and LogoFail, a separate set of issues involving image rendering in firmware. These examples explain why early-boot code can have broad security consequences, but they do not establish that the vulnerabilities share the same cause or impact.
“An attacker intent on compromising a nearby endpoint or server could use this bug to hijack program flow at a point where the boot process still has access to sensitive components, like the endpoint’s TPM.”
— HD Moore, Dragos chief research officer and creator of Metasploit, speaking to Ars Technica
Affected Firmware Still Unmapped
The available material does not identify a complete list of affected hardware models, firmware builds or cloud platforms, nor does it state how many devices are vulnerable. It is also unclear which vendors have issued updates, whether specific products are exposed when PXE boot is disabled, or how quickly firmware updates can reach deployed systems.
The report describes a route to denial of service and, under particular conditions, code execution, but does not report confirmed attacks exploiting CVE-2026-97631. It also does not establish that a working exploit is publicly available. Although patch code was exposed, the extent to which attackers have analyzed it or developed tools remains unknown.
Vendor Advisories and Firmware Fixes
Hardware makers and firmware suppliers will need to determine which products include the vulnerable EDK2 component and publish product-specific guidance or updates. Administrators should follow advisories from their server and hardware vendors rather than assume that every EDK2-based system is affected or that a generic code fix can be installed directly.
The next concrete developments to watch are vendor notices naming affected firmware versions, the release and availability of signed updates, and guidance on whether PXE boot can be safely disabled while systems await fixes. The source material provides no confirmed patch schedule or final coordinated-disclosure date beyond the original plan for January.
Key Questions
What is CVE-2026-97631?
It is a reported memory-corruption flaw in EDK2’s PXE Base Code driver. During network boot, oversized ICMP error messages can be copied past a fixed-size field.
Can the flaw execute code on a server?
The report says code execution is possible in particular circumstances during PXE boot, before the operating system and Secure Boot defenses are active. It also describes a possible denial of service. The report does not confirm attacks in the wild.
Are most servers confirmed to be vulnerable?
No. EDK2 is widely reused, but the available report does not provide a complete affected-product list or a count of vulnerable servers. Exposure depends on the firmware in a specific device and its configuration.
What should administrators do?
Check for product-specific advisories from the server, motherboard and firmware vendors. Confirm whether affected firmware versions are present and follow vendor guidance on updates or temporary PXE boot restrictions.
Does the initial malicious code persist after reboot?
The report says the payload delivered through this flaw does not persist by itself. It could, however, provide an opening for an attacker to install a separate payload that does persist.
Source: arstechnica.com
