UEFI flaw lets attackers run code before Secure Boot on servers

A critical 16-year-old flaw in EDK II, the open-source foundation used by most hardware makers to build UEFI firmware, could allow code to run on a machine before the operating system loads during a network boot. The bug is in the PXE network-boot path and stems from a buffer overflow that occurs when the PXE driver copies ICMP error messages into a fixed 504-byte memory area.

If an attacker sends a crafted error message while a server is booting over the network, the boot can hang, and with a build-specific payload they may even execute their own code before Secure Boot and other checks, before any reboot. The advisory notes the impact requires proximity to the target network and no password or prior access is needed.

Affected software includes EDK II up to and including edk2-stable202608, the latest stable branch dated 21 August. Red Hat and SUSE ship the affected code, with Red Hat listing it as exploited from an adjacent network position and not from the public internet; Microsoft’s Project Mu has already integrated the fix into its releases. The flaw is tracked as CVE-2026-97631 and was disclosed after a patch was merged into the EDK II source on 15 October, though no stable release contains the fix at publication.

A workaround is not listed in the advisory; operators who do not rely on PXE can disable it, and watchdogs should monitor boot-time network traffic. The researchers credited are Alex Matrosov of Anthropic and Dan Holmes-Mitra of Google; the coordinated disclosure was planned for January 2027 but the vulnerability was described publicly in a pull request on 28 September. No exploitation has been publicly confirmed, and CISA had not listed it in its Known Exploited Vulnerabilities catalogue as of 27 October.