EDK II — Critical 16-Year-Old UEFI Firmware Flaw Allows Code Execution Before Secure Boot on Network-Booting Servers (CVE-2026-97631)

Publication date: October 28, 2026
Category: Vulnerability / Network Security

Introduction

A critical 16-year-old architectural flaw in EDK II, the open-source codebase utilized by most hardware manufacturers to build UEFI firmware, exposes servers and data center infrastructure to a severe attack vector. Tracked as CVE-2026-97631 with a CVSS v4.0 score of 9.5 (CRITICAL), the vulnerability allows an attacker on an adjacent network to execute arbitrary code on a target machine before the operating system and startup defenses like Secure Boot load. The finding was credited to Alex Matrosov of Anthropic and Dan Holmes-Mitra of Google, initially scheduled for coordinated disclosure before premature public activity on the official code repository accelerated the advisories.

What is EDK II and Vulnerability CVE-2026-97631? (General Analysis)

UEFI firmware is the low-level software initialized immediately upon powering on a computer, setting up hardware components before transferring control to the operating system. EDK II (EFI Development Kit II) serves as the baseline reference code upon which independent BIOS vendors (AMI, Insyde, and Phoenix) and hardened forks like Microsoft’s Project Mu are constructed.

The core vulnerability resides within EDK II’s network-boot subsystem, known as PXE (Preboot Execution Environment). Specifically, the component responsible for listening to ICMP error messages and small status messages sent during a network boot lacks proper bounds checking when copying these packets into a fixed 504-byte memory buffer.

Official NVD Data (Confirmed Facts)

  • CVE Identifier: CVE-2026-97631
  • Official CVSS Score and Vector (v4.0): CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X — 9.5 (CRITICAL)
  • Official CWE Classification:
    • CWE-120: Classic Buffer Overflow
    • CWE-131: Incorrect Calculation of Buffer Size
    • CWE-787: Out-of-bounds Write
  • CISA KEV Catalog: Not reported (as of October 27, 2026).

How Does It Work? (Technical Analysis)

The exploitation mechanism leverages how EDK II’s PXE driver processes network traffic during the pre-boot phase.

  • Initial Entry and Overflow Flow: During a PXE boot, a machine loads its startup image over the network. The PXE driver listens for incoming ICMP error messages and status updates, copying each into a fixed 504-byte memory region. Due to incorrect size calculation logic in both IPv4 and IPv6 implementations, messages exceeding 504 bytes trigger an Out-of-bounds Write, spilling past the boundary and overwriting adjacent memory with attacker-controlled data.
  • Execution and Persistence: To trigger this, an attacker must transmit a crafted error message to the target IP address precisely during its network-boot window, requiring no prior credentials or access. While simple delivery causes a boot crash, tailored crafting against a precise firmware build allows an attacker to plant a “counterfeit event” that forces the firmware to execute malicious code. This code executes entirely within the firmware before Secure Boot verifies integrity checks. Execution is volatile and does not survive a reboot on its own, but a single run is sufficient to compromise sensitive components like the TPM or install persistent payloads.
  • Network Positioning: Although network-accessible, Linux distributors such as Red Hat and SUSE rate the flaw as exploitable primarily from an adjacent network position (lateral movement following initial network footholds) requiring strict timing synchronization.

Affected Systems / Environments

The vulnerability impacts a broad global ecosystem of servers and enterprise hardware running EDK II-derived firmware with PXE enabled by default.

  • EDK II Versions: Affects EDK II up to and including edk2-stable202608 (released August 21, 2026). The flawed copy loop dates back to a commit introduced in November 2010.
  • Linux Distributions: Packages for Red Hat Enterprise Linux (RHEL 8, 9, and 10), SUSE, and Debian.
  • Firmware Vendors / OEMs: Vendors building upon EDK II reference code (AMI, Insyde, Phoenix, Microsoft Project Mu). Note: Intel and Arm stated their commercial product portfolios under direct support do not implement the affected EDK2 functionality directly in their baseline reference code, though third-party OEM board makers might have integrated it.
CVE Category (CWE) Impact CVSS Vector (Summary)
CVE-2026-97631 CWE-120, CWE-131, CWE-787 Total Confidentiality, Integrity, and Availability (Critical) 9.5 (Critical) AV:N/AC:L/AT:P/PR:N/UI:N (CVSS v4.0)

Mitigation and Detection

Remediation

  • Firmware Updates: TianoCore has merged a source-level patch into the main development branch that truncates oversized messages at 504 bytes. However, because no stable release contains this fix yet, server operators must await official BIOS/UEFI updates from their respective hardware and motherboard vendors.
  • Disable PXE Boot: As an immediate hardening measure, organizations that do not rely on network booting should disable PXE in their server UEFI/BIOS settings to eliminate exposure.
  • Upstream and Downstream Actions: Microsoft’s Project Mu has pulled the fix into release branches. Linux distributions are actively tracking and preparing updated firmware packages.

Detection

  • Network Monitoring: Inspect pre-boot network traffic for anomalous ICMP payloads or oversized PXE status messages targeting server subnets.
  • Boot Log Auditing: Review server management infrastructure logs for intermittent boot failures or abnormal driver buffer behaviors.

“An attacker intent on compromising a nearby endpoint or server could use this bug to hijack program flow at a point where the boot process still has access to sensitive components, like the endpoint’s TPM, potentially bypassing disk encryption mechanisms.”

Wrapping Up

The disclosure of CVE-2026-97631 highlights the enduring risks embedded in legacy, low-level codebases supporting modern enterprise infrastructure. By enabling code execution prior to Secure Boot verification, this buffer overflow in EDK II’s PXE subsystem poses a severe threat to data center security. Effective defense requires disabling unnecessary network-boot functions and applying vendor-supplied firmware patches as soon as they become available.

References