TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
A memory-corruption flaw in TianoCore EDK II can let an attacker execute code during a device’s network boot sequence, before operating-system protections load. The flaw is rated 9.5 out of 10 and affects code used across a broad range of UEFI firmware, but the reach across deployed systems and the pace of vendor fixes are not yet known.
TianoCore EDK II, an open-source codebase used by many hardware and cloud providers to build UEFI firmware, contains a memory-corruption flaw that can let attackers execute code during network boot, before the operating system starts. Tracked as CVE-2026-97631 and rated 9.5 out of 10, the vulnerability has prompted concern because firmware updates must pass through many manufacturers and deployed devices.
The bug is in EDK II’s PXE Base Code driver, which supports booting devices from code delivered over a local network. During that process, the driver listens for ICMP error messages. The project advisory says the IPv4 and IPv6 handlers copy received data into a fixed 504-byte field without correctly stopping oversized messages, allowing attacker-controlled bytes to overwrite adjacent memory.
According to the report, an attacker must reach the target during its PXE boot sequence and send a crafted network message. The advisory describes a denial-of-service outcome in which boot can hang; with knowledge of the target firmware build, an attacker may also be able to corrupt execution and run code in the UEFI environment. The report says this code runs at ring 0, the processor’s most privileged level, before protections such as Secure Boot can operate.
The vulnerability was found by Alex Matrosov of Anthropic and Dan Holmes of Google, Ars Technica reported. The researchers had planned coordinated disclosure for January, but a public AMI pull request containing details and a fix appeared last month. TianoCore members then published an advisory last week, the report said. Public patch code can help defenders, but it also gives attackers information for developing exploits.
Firmware Exposure Before Secure Boot
The risk comes from the point in startup where the flaw operates. Code execution in UEFI firmware happens before the operating system and its usual security controls load. The report says an attacker may gain access to sensitive components, including the Trusted Platform Module (TPM), and potentially undermine protections that rely on a trusted startup sequence.
HD Moore, chief research officer at Dragos and creator of Metasploit, told Ars Technica that an attacker targeting a nearby server or endpoint could hijack program flow while the boot process still has access to sensitive components. He said this could be used to break disk encryption in some circumstances, particularly if an attacker has short-term network access or physical access to a stolen device. These are potential consequences, not evidence that the flaw has been exploited in the wild.
Response is difficult because EDK II is reference code incorporated by numerous firmware suppliers, including AMI, Insyde and Phoenix, as well as Microsoft’s Project Mu fork, according to the report. Each vendor and device maker must determine whether its products contain the affected code, prepare and distribute suitable firmware, and support installation across a large installed base.
Products Worth Considering
LG UltraGear 27-Inch QHD OLED Gaming Monitor, 240Hz, 0.03ms, G-SYNC Compatible, FreeSync Premium Pro, HDMI 2.1
Jackery HomePower 3000 Portable Power Station with Two 200W Solar Panels
DJI Osmo Pocket 3 Creator Combo Vlogging Camera with Mic 2, 1 CMOS, 4K/120fps, 3-Axis Stabilization, 128GB Card
As an affiliate, we earn on qualifying purchases.
How the PXE Boot Bug Emerged
EDK II is an open-source implementation used to build UEFI firmware, the software that runs when a computer starts. The UEFI Forum has described it as a leading implementation of its specifications, Ars Technica reported. Its use by suppliers does not mean every product contains the affected driver or is exposed in the same way; that depends on each firmware build and configuration.
The vulnerable component is tied to pre-execution environment (PXE) boot, which lets servers, storage equipment and other devices load startup code from a network. The report describes the buffer overflow as a 16-year-old flaw in the driver. It also compares the issue with PixieFail, another set of flaws involving EDK II PXE boot, and LogoFail, which involved image-rendering issues in UEFI. Those precedents provide context for firmware risk, but they are separate vulnerabilities.
The disclosure timeline became public after AMI posted a pull request describing the bug and including a fix, according to the report. The researchers had intended to keep the issue confidential until a coordinated release scheduled for January. The report does not specify the year for that planned date, so the timing and intended release schedule cannot be independently inferred from the supplied material.
““An attacker intent on compromising a nearby endpoint or server could use this bug to hijack program flow at a point where the boot process still has access to sensitive components, like the endpoint’s TPM.””
— HD Moore, Dragos chief research officer and Metasploit creator, as quoted by Ars Technica
Affected Devices and Exploitation Status
The supplied reporting does not identify a complete list of affected products, firmware versions or device configurations. EDK II’s broad adoption indicates potential reach, but it does not establish that every server or every UEFI system is vulnerable. Device makers need to determine whether their firmware includes the vulnerable component and whether the relevant network-boot conditions apply.
The material also does not report confirmed exploitation in real-world attacks, nor does it say whether working public exploits exist. It describes the risk that attackers could use the public technical details and patch to develop one. The number of systems exposed to network boot, the availability of vendor updates, and the time required for deployment remain unknown.
The source says the final payload delivered through the flaw does not persist by itself and runs only once. It may, however, provide an opening to install other components that do persist in early boot. That distinction describes a possible attack path, not a reported outcome of a known incident.
Vendor Advisories and Firmware Updates
Hardware and firmware vendors will need to assess their products, publish security guidance and provide updated firmware where required. Administrators should look for advisories from the manufacturers of their servers and other network-boot-capable devices, then follow each vendor’s instructions for identifying affected builds and applying fixes. The supplied report does not give a universal patch or one update that covers all products.
Further clarity should come from vendor notices identifying affected models and firmware releases, as well as updates from the EDK II project. The disclosure was already public at the time of the report, raising pressure to move from code-level fixes to updates that can be installed across the varied hardware ecosystem. How quickly that work can reach deployed devices is still unsettled.
Key Questions
What is CVE-2026-97631?
It is a memory-corruption vulnerability in EDK II’s PXE Base Code driver. The flaw can allow oversized ICMP error messages received during network boot to overwrite memory beyond a fixed-size field.
Does the flaw affect every server?
No complete affected-device list is provided. EDK II is widely used in firmware development, but exposure depends on whether a product includes the vulnerable code and is configured to encounter the relevant PXE boot conditions.
Can attackers exploit it remotely?
The report says a malicious ICMP error can be sent to a target’s IP address during its network boot sequence, including by unicast. It describes the attacker as needing access to the relevant network path; it does not establish that all internet-connected devices are reachable or vulnerable.
Are attacks using the flaw confirmed?
The supplied report does not confirm exploitation in the wild. It warns that the public advisory and patch details could help advanced attackers develop an exploit.
What should device operators do?
Check security notices from the server or hardware manufacturer for affected models and firmware updates. The source material does not provide a single patch applicable to all vendors, so remediation instructions will vary by product.
Source: arstechnica.com
