A 16-year-old UEFI flaw puts server firmware at risk

CVE-2026-97631 is a critical, 16-year-old vulnerability in the UEFI firmware commonly used to boot servers. The flaw resides in the PXE-Base Code driver (NetworkPkg/UefiPxeBcDxe) within the TianoCore EDK II open‑source project, which is used by hardware makers and cloud providers to build UEFI firmware and is present in major vendors such as AMI, Insyde and Phoenix.

The advisory notes an out-of-bounds write, a classic buffer overflow and incorrect calculation of buffer size in the driver’s handling of ICMP error messages during PXE boot. Exploitation can allow arbitrary code execution before the operating system loads and before Secure Boot or measured boot have verified components, potentially compromising confidentiality, integrity and availability.

The attack would require an attacker with local network access who can inject ICMP errors during PXE boot; this could come from an insider or an attacker who already has foothold on the target network. The CVSS is stated as 9.5/10. The advisory explains that the vulnerable 504-byte field, Mode[.]IcmpError, is written past its bound when longer ICMP messages arrive, enabling code execution in the DXE phase before security protections are active.

While there is no evidence the flaw enables initial network access from outside, it could enable an attacker to install other components that run at riskier privileges. AMI published a fix last month, and Tianocore issued a public warning; Intel and Arm say their products are not directly affected, though vendors may ship vulnerable code.

Organisations are advised to contact firmware suppliers, disable network boot where possible, and monitor logs, noting that TPM and Secure Boot offer limited protection against this vector.