Security researchers identified a critical memory-corruption vulnerability in TianoCore EDK II, a widely used open source codebase for UEFI firmware, as first reported by Ars Technica.
The vulnerability, tracked as CVE-2026-97631, carries a severity rating of 9.5 out of 10 and affects the PXE-Base Code driver. This flaw allows attackers to execute malicious code during the boot sequence before the operating system and security defenses, such as Secure Boot, are initialized. The issue stems from a 16-year-old buffer overflow in the ICMP component, where the driver fails to enforce memory copy limits. By sending a specially crafted error message during a network boot, an attacker can overwrite adjacent data and gain privileged access at the CPU ring 0 level. Because the vulnerability resides in foundational firmware used by most server vendors and data centers, it poses significant risks to enterprise environments. While exploitation requires local network access and specific target tuning, the potential for bypassing security attestation makes it a serious concern. Organizations are advised to contact their hardware manufacturers for firmware updates and consider disabling network boot capabilities until patches are applied.
Source: Ars Technica
