A buffer overflow in EDK II, the open-source code most hardware makers use to build UEFI firmware, can let an attacker run code on a machine before its operating system or Secure Boot checks have loaded. The flaw, CVE-2026-97631, sits in the driver for PXE network boot, where a machine fetches its startup image over the network. While it is mid-boot, the driver copies incoming ICMP error messages into a fixed 504-byte field, and the length checks in both the IPv4 and IPv6 versions are wrong. TianoCore’s advisory, published on 22 October, rates it 9.5 out of 10: an unauthenticated attacker who can send a crafted ICMP error message to the machine during a PXE boot can corrupt firmware memory.
The reliable result is a hung boot. Code execution is harder: the advisory says an attacker who knows the exact firmware build can plant a forged event to run their own code. Per The Hacker News, that code runs once and does not persist across a reboot, but it runs before Secure Boot or measured boot has checked anything, which is enough to install something that does persist. The vulnerable copy loop dates to a November 2010 commit, per The Hacker News, and the advisory lists EDK II up to and including edk2-stable202608.
A fix reached EDK II’s main development branch on 15 October, but TianoCore’s advisory still lists the patched version as “Not patched currently” and no stable release contains it. Microsoft’s Project Mu fork cut tagged builds with the fix on 26 October. The bug was found by Alex Matrosov of Anthropic and Dan Holmes-Mitra of Google; a planned January 2027 coordinated disclosure was overtaken when a public pull request on 28 September described the flaw by its CVE number, according to The Hacker News.
How to check if you’re affected
Affected products are machines whose firmware is built on EDK II and that boot over the network with PXE, mainly servers and data-center equipment. The Hacker News says it does not affect home or office users who boot only from a local disk. How many shipping products carry the vulnerable code is not known: per The Hacker News, Intel told Ars Technica none of its commercial products under security support are known to be affected, Arm said the flaw is not directly applicable to its portfolio, and AMD, Phoenix, AMI, Microsoft and Amazon had not answered Ars’s questions at publication.
- Red Hat lists its
edk2package in RHEL 8, 9 and 10 as affected and not yet fixed; SUSE and Debian mark their equivalent packages the same way. - Ask your server or BIOS vendor whether your firmware version includes the EDK II PXE code and when a build with the fix will ship. Operators have nothing to install until that update arrives.
- The advisory lists no workaround. If you do not need PXE, disabling network boot reduces exposure, since the flaw can only be reached during a network boot.
- The Hacker News reports Ars advised watching boot-time network traffic and logs for attempts. The advisory describes the trigger as an ICMP error message delivered to the client during PXE boot.
Sources
- EDK II security advisory GHSA-99cj-7hg9-mp4m (TianoCore)
- NetworkPkg/UefiPxeBcDxe: Fix ICMP buffer overflow in IPv4/IPv6 handle (CVE-2026-97631), pull request #13302 (TianoCore)
- CVE-2026-97631 (Red Hat)
- Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers (The Hacker News)
- Code execution flaw in UEFI firmware threatens most servers (Ars Technica)