Critical 9.5-Severity Flaw CVE-2026-97631 Found in TianoCore EDK II UEFI Firmware

7.4 · 4d ago · WORLD · TECH

The Facts

  • CVE-2026-97631 is a memory-corruption (buffer overflow) flaw in the TianoCore EDK II open source codebase used to build UEFI firmware, rated 9.5 out of 10 in severity. Ars Technica only
  • The flaw is in the PXE Base Code driver (NetworkPkg/UefiPxeBcDxe), in the ICMP error handlers for IPv4 and IPv6 (PxeBcIcmpErrorDpcHandle and PxeBcIcmp6ErrorDpcHandle), and is 16 years old. Ars Technica only
  • The driver copies ICMP error messages into a fixed 504-byte field (Mode.IcmpError) without enforcing the limit, and advances the destination pointer by cumulative rather than per-fragment length, so oversized messages write attacker-controlled bytes past the field. Ars Technica only
  • A malicious ICMP error sent as a unicast to the target's IP address during the PXE boot sequence can trigger the flaw, enabling code execution in ring 0 before the OS and defenses like Secure Boot load, or a denial of service by hanging the boot. Ars Technica only
  • Code execution requires knowing the target firmware build; resulting payloads do not persist but can be used to install other payloads that run early in each boot. Ars Technica only
Dive deeper · 4 more factsShow less
  • The flaw was discovered by Alex Matrosov of Anthropic and Dan Holmes of Google, who had planned coordinated disclosure for January. Ars Technica only
  • AMI published a pull request last month detailing the vulnerability and including a code fix; TianoCore Project members then published a public advisory last week. Ars Technica only
  • Virtually all UEFI suppliers, including AMI, Insyde and Phoenix, use EDK2 reference code extensively, as does Microsoft's Project Mu fork. Ars Technica only
  • HD Moore of Dragos said the bug could let an attacker hijack boot flow while sensitive components like the TPM are accessible, potentially breaking disk encryption with short-term network access. Ars Technica only

Context

A critical buffer overflow in the TianoCore EDK II codebase, which underpins UEFI firmware from most major vendors, was publicly disclosed earlier than planned. The flaw, tracked as CVE-2026-97631, affects the PXE network boot driver's handling of ICMP error messages.

The discoverers had scheduled coordinated disclosure for January, but a public AMI pull request containing the fix surfaced the details. Ars Technica reports that the public patch code makes exploit development easier, and that patching firmware across many devices is slow.

How the Agent Panel Scored This

Independent AI personas each scored importance 1–10; the story's score is a trimmed mean (highest and lowest votes dropped). Vote spread: 2.

8 Global Affairs Analyst A critical 9.5-severity pre-boot firmware flaw in EDK2, which underpins UEFI firmware across most major vendors, was disclosed early and its public patch aids exploitation, a concrete security event with broad potential impact.
8 Informed Citizen A critical 9.5-severity pre-boot firmware flaw in EDK II, used by most UEFI vendors, is a concrete vulnerability with widespread potential impact on device security, though exploitation requires specific conditions and patches are still rolling out.
8 Science & Tech Analyst A 9.5-severity, 16-year-old pre-boot firmware flaw in EDK2, underlying UEFI firmware from nearly all major vendors, was disclosed early via a public patch, creating significant risk for many systems even though exploitation requires network proximity and target-specific knowledge.
7 Business Analyst A 9.5-severity pre-boot firmware flaw in EDK2, used by most UEFI vendors, is a significant security event affecting many devices, though it is a vulnerability disclosure rather than a market-moving corporate or regulatory action and requires network proximity to exploit.
7 News Editor A critical 9.5-severity pre-boot firmware flaw in EDK II, used by most UEFI vendors, was publicly disclosed early with a public patch, creating broad exposure though exploitation requires network position and target-specific knowledge and it is a single-source report.
7 Critical Reader A verified critical pre-boot firmware flaw in EDK2, used by most UEFI vendors, was publicly disclosed early with a public fix, creating broad exposure, though it is single-sourced and no confirmed in-the-wild exploitation is reported.
6 Policy Expert A critical 9.5-severity firmware vulnerability in widely used EDK2 code is significant security news with broad potential impact, but it is a disclosed flaw rather than an enacted law, ruling, or government action, and it has only one independent source and no confirmed mass exploitation.

Source

← All stories