A critical code-execution vulnerability in TianoCore EDK II, the open-source codebase used to build UEFI firmware for servers, data centers and other devices, could allow attackers to run malicious code during the boot process—before operating-system or firmware defenses take effect. Tracked as CVE-2026-97631 and rated 9.5 out of 10, the flaw affects a widely used PXE networking component and could undermine protections such as Secure Boot and the Trusted Platform Module (TPM).
A vulnerability in widely used UEFI firmware code
EDK II is an open-source codebase used by hardware manufacturers and cloud providers to create UEFI firmware that runs during the boot sequence. The UEFI Forum described EDK2 last year as a “great solution/implementation of the UEFI specification.”
Virtually all UEFI suppliers—sometimes called independent BIOS vendors, or IBVs—including AMI, Insyde and Phoenix, use the reference code extensively. Microsoft’s enhanced EDK2 fork, Project Mu, also included code containing the vulnerable components.
CVE-2026-97631 is a memory-corruption flaw in the ICMP component of the EDK2 network stack. An attacker could exploit it to execute code before the operating system or firmware applies defenses such as Secure Boot, which establishes a chain of trust for executable code, and the Trusted Platform Module (TPM), which is initialized during startup.
The final payload delivered through CVE-2026-97631 is nonpersistent, meaning it runs only once. However, it could give an attacker extensive opportunities to install additional payloads that execute during the early stages of every subsequent boot.
Coordinated disclosure disrupted
Alex Matrosov of Anthropic and Dan Holmes of Google discovered CVE-2026-97631 and agreed to keep it confidential until a coordinated disclosure scheduled for January. However, AMI, a manufacturer of motherboards and other hardware, published a pull request last month that detailed the vulnerability and included a code fix.
After the post drew the discoverer’s attention, members of the TianoCore project published a public advisory last week.
Public patches can help advanced attackers understand how a vulnerability is triggered and develop working exploits. Patching UEFI code across millions of end devices made and sold by thousands of hardware manufacturers and cloud providers is also cumbersome and time-consuming.
The disclosure came six days after another failed disclosure involving a critical code-execution vulnerability in the PHP programming language.
How the PXE flaw works
“This vulnerability in the ICMP parser of the EDK2 network stack is interesting because of how it impacts the chain of trust and the broader ecosystem,” said HD Moore, creator of Metasploit and chief research officer at security firm Dragos.
“An attacker looking to compromise a nearby endpoint or server could leverage this bug to hijack the program flow at a point where the boot process still has access to sensitive components such as the endpoint’s TPM. This could be used to break disk encryption if the attacker gains short-term network access, which is even easier in theft scenarios.”
CVE-2026-97631 is a 16-year-old buffer overflow in the PXE base-code driver, NetworkPkg/UefiPxeBcDxe. The driver allows servers, storage equipment and other devices to boot using code downloaded from the local network.
During this process, known as a pre-execution environment boot, the driver listens for ICMP errors. Because it does not enforce a 504-byte limit on memory copies, a malicious insider or an attacker with low-level access to the local network could send an error message containing more data than the buffer can hold. The excess data overwrites adjacent memory and corrupts the UEFI module running on the processor, enabling the attacker to alter program execution during the boot process.
Source: www.wired.com