UEFI flaw allows code execution before operating system loads

CVE-2026-97631 is a memory-corruption flaw in TianoCore’s EDK II, an open-source codebase used by many hardware makers and cloud providers to build UEFI firmware. Rated 9.5 out of 10, the 16-year-old buffer overflow is in the PXE-Base Code driver, which supports booting devices from a local network. During network boot, the driver handles ICMP error messages but fails to limit copying to a 504-byte memory field.

An attacker able to send an oversized message can overwrite adjacent data and, under suitable conditions, run code in the firmware before the operating system and protections such as Secure Boot load.

The flaw affects systems using EDK II and its PXE functionality; it does not affect devices that boot solely from disk. Exploitation requires access to the target’s network during the PXE boot sequence, and working code must be tailored to the target’s firmware build and configuration. Attackers can also cause the boot process to hang. Researchers Alex Matrosov of Anthropic and Dan Holmes of Google discovered the flaw.

A fix was publicly exposed in an AMI pull request before the planned coordinated disclosure, after which TianoCore issued an advisory. There is no evidence that the vulnerability is being used to gain initial access to networks.

Intel said it knew of no affected commercial products still under security support, while noting that OEMs might integrate the vulnerable functionality. Arm said the flaw was not directly applicable to its product portfolio. Other vendors had not responded when the story was published, leaving the affected systems unclear. Organisations are advised to ask their firmware supplier for guidance and, if possible, temporarily disable network boot.