Code-execution flaw in UEFI firmware affects most servers on planet Earth
ars ·
A critical code-execution vulnerability, CVE-2026-97631, has been identified in the TianoCore EDK II open-source firmware used by most server vendors worldwide. Rated 9.5 out of 10 in severity, this flaw allows attackers to execute malicious code early in the boot process before defenses like Secure Boot and TPM can activate. The bug is a 16-year-old buffer overflow in the PXE network driver that fails to limit memory copies for ICMP error messages during network booting. Although the initial payload lacks persistence, it enables attackers to install other malicious components that run at every startup. The vulnerability was disclosed prematurely after a hardware vendor published a fix, prompting researchers to release a public advisory ahead of the scheduled January date. Exploitation requires low-level access to a local network and specific knowledge of target system configurations, limiting its use primarily to insiders or advanced threat actors. Major technology companies including Intel and Arm have stated their direct products are not affected, though many OEMs rely on the vulnerable EDK2 codebase. Organizations are advised to check with firmware manufacturers and consider disabling network boot capabilities as a temporary mitigation.
ars