A critical vulnerability, tracked as CVE-2026-97631, has been identified in the TianoCore EDK II codebase, which is widely used by hardware manufacturers and cloud providers for UEFI firmware. The flaw, which carries a severity rating of 9.5 out of 10, stems from a 16-year-old memory-corruption issue in the PXE-Base Code driver.
The vulnerability allows attackers with local network access to execute malicious code during the pre-execution environment boot sequence. By sending oversized ICMP error messages that exceed the 504-byte limit, an attacker can corrupt the UEFI module and run code at the CPU's most privileged execution level, ring 0.
Discovered by Alex Matrosov of Anthropic and Dan Holmes of Google, the flaw was disclosed after a pull request from AMI exposed the issue prematurely. While the vulnerability does not affect devices booting solely from disk drives, it poses a risk to servers and storage equipment configured for network booting.
Exploitation requires tuning for specific target models and configurations, as attackers must guess memory addresses. Although a code fix is available, patching millions of devices across various vendors remains a complex and time-consuming process for organizations.
Intel and Arm have stated that their current commercial products under security support are not directly affected, though they acknowledge that OEM vendors may integrate the vulnerable EDK2 functionality into their own systems. Affected users are advised to contact their firmware manufacturers for guidance.
