Researchers from Anthropic and Google identified a critical vulnerability, CVE-2026-97631, within the TianoCore EDK II open-source framework. The flaw, which carries a severity rating of 9.5 out of 10, resides in the PXE driver's ICMP message processing component. It allows an attacker with local network access to execute arbitrary code at the UEFI firmware level before the operating system or Secure Boot mechanisms initialize.
EDK II serves as the reference implementation for UEFI, widely adopted by major server hardware manufacturers such as AMI, Insyde, and Phoenix, as well as cloud providers. The vulnerability involves a 504-byte buffer overflow triggered by oversized ICMP packets during network booting. Successful exploitation requires precise knowledge of the firmware's address space but can compromise the chain of trust, potentially exposing TPM-stored disk encryption keys.
Although a coordinated disclosure was planned for January 2027, AMI prematurely released a pull request detailing the flaw and its fix. Following this, the TianoCore Project issued an official advisory. While patches are now available, industry experts warn that deploying firmware updates across millions of affected devices will take several months to complete.
The risk is limited to systems utilizing PXE network booting; home users booting from local drives remain unaffected. Experts suggest that CVE-2026-97631 may persist as a long-term threat in legacy hardware. As a temporary mitigation, administrators are advised to disable PXE booting and monitor network logs for signs of exploitation attempts.
