Science & Tech · Cybersecurity · 2 hrs ago
Critical UEFI flaw could let attackers run code before servers start
A critical flaw in EDK II firmware could let attackers run code before a server’s operating system starts.
EDK II is an open-source project used by hardware makers and cloud providers to build UEFI, the software that starts a computer.
The 16-year-old bug is in a driver used when devices boot from code downloaded over a local network.
An attacker who can reach a target’s network during this boot process can send messages that trigger the flaw.
The vulnerability has a severity score of 9.5 out of 10, and the code could run with the computer’s highest level of privilege.
Because this can happen before some startup protections take effect, it could help an attacker gain deeper control.
The attack requires access to the local network, such as through an insider or an attacker who already has a foothold there.
Exposed systems need firmware patches and checks, though the available information does not specify when those patches will be released.
A critical flaw in TianoCore EDK II UEFI firmware could let attackers run code before a server’s operating system starts.
Tracked as CVE-2026-97631, the flaw has a CVSS score of 9.5.
The 16-year-old buffer overflow affects a driver used during network boot and can be triggered by specially crafted ICMP error messages.
An attacker needs control of, or a foothold on, the target’s local network to send those messages during PXE boot.
The articles say exposed systems need firmware patches and checks, but do not provide details of specific patches.
- Who
- Attackers with access to the target’s local network, including malicious insiders, could exploit the flaw.
- What
- A UEFI firmware flaw could allow arbitrary code execution before the operating system loads.
- When
- The articles were published on October 27 and 28, 2026; the flaw is described as 16 years old.
- Where
- In TianoCore EDK II UEFI firmware, specifically the PXE-Base Code driver used for network boot.
- Why
- The driver mishandles oversized ICMP error messages, allowing data to be written beyond a fixed-size buffer.
This story does not have two clearly opposing sides.
Ars Technica published an article about the code-execution flaw in EDK II firmware.
Security Affairs published details of CVE-2026-97631 and its impact on network-booting systems.
- CVE
- CVE-2026-97631
- CVSS score
- 9.5 out of 10
- Affected project
- TianoCore EDK II
- Affected driver
- PXE-Base Code driver, NetworkPkg/UefiPxeBcDxe
- Buffer size
- 504 bytes
3 sources
What people are saying
Successful exploitation of this vulnerability can lead to arbitrary code execution.
While a machine is PXE-booting over IPv4 or IPv6, an unauthenticated network attacker who can deliver ICMP error messages to it can corrupt DXE-phase memory and execute arbitrary code before the operating system loads, before Secure Boot or measured boot has verified or measured any OS component.