Code-execution flaw in UEFI firmware affects most servers on planet Earth
Critical flaw in EDK2 allows attackers to execute code early in the boot process.
TL;DR
- A critical vulnerability, CVE-2026-97631, exists in the TianoCore EDK II UEFI firmware, impacting most server vendors and data centers.
- The flaw allows attackers to execute malicious code during the boot process, before OS defenses are active.
- The vulnerability stems from a buffer overflow in the PXE-Base Code driver's ICMP parser, which doesn't enforce a memory copy limit.
- Premature public disclosure of the vulnerability, including a code fix, accelerates the risk of exploit development.
- Patching UEFI firmware across millions of devices is cumbersome and time-consuming, potentially leaving systems vulnerable long-term.
- Exploitation requires some level of control over a local network and is tuned for specific target configurations.
- Intel and Arm state their direct products are not affected, but acknowledge reliance on EDK2 by OEMs and system manufacturers.
- Organizations with affected systems should check with firmware makers, consider disabling network boot, and monitor logs.