CVE-2026-97631 appears to affect a narrow class of systems: organizations whose machines boot from resources connected to a local network or possibly the Internet. Home users, small-office users, and others who boot only from a disk drive are not affected. The vulnerability applies when the system firmware relies on EDK2 and uses PXE functionality, which is enabled by default, rather than a separate reference implementation.
Intel says supported commercial products are not known to be affected
Intel said in an email that none of its “commercial products currently receiving security support” are known to be affected. “Intel has not included the affected EDK2 features in its reference code, but they may be integrated by OEM board vendors and system manufacturers,” the company added.
Intel advised customers to check with their system manufacturers for specific guidance. Intel’s publicly available reference code references EDK2. TianoCore said that Intel describes each UEFI development kit it offers as “a fully verified implementation against a specific revision of the EDK II sources.” Many other Intel documents also refer to EDK2.
Arm says the vulnerability does not directly apply to its products
Arm responded to a series of questions by saying, “CVE-2026-97631 does not directly apply to Arm’s product portfolio.” Like Intel, Arm makes firmware available that borrows heavily from EDK2. TianoCore also documented that Arm depends on EDK2.
Although some platforms may not include EDK2 code, it is prudent to investigate whether users of all servers are affected by CVE-2026-97631.
Other vendors have not yet provided answers
At the time this article was published, AMD, Phoenix Technologies, AMI, Microsoft, and Amazon had not answered questions about the vulnerability. They appear to be among the other largest organizations potentially affected.
Without specific information about whether these organizations use EDK2, it is impossible to determine whether, or how, their devices may be affected and what actions, if any, the organizations or their users should take. Representatives of the TianoCore project also did not respond.
Source: arstechnica.com