EDK II Flaw Rated 9.5 Can Expose PXE-Booting Systems to Code Execution

TianoCore disclosed a critical flaw in EDK II firmware that can let an attacker run code during network startup, before Secure Boot checks and the operating system load. The vulnerability, CVE-2026-97631, has a CVSS severity score of 9.5.

The defect is in EDK II’s PXE network-boot driver. The component stores ICMP error data in a 504-byte buffer, but its size check can fail to reject longer packets, allowing excess data to overwrite nearby memory.

An attacker does not need credentials, but must get a crafted ICMP packet to the target during the brief PXE startup window. The attack also requires guessing a target-specific address and adapting the exploit to the system’s firmware and configuration.

The stated exposure applies to systems with EDK II-based firmware and PXE boot enabled. Systems that boot only from local storage do not meet that condition. AMI, Insyde and Phoenix are among the vendors using the reference code.

A fix entered EDK II’s main development branch Oct. 15, but the stable release remained unpatched. Microsoft Project Mu has incorporated the fix; edk2 packages from Red Hat, SUSE and Debian remained unpatched.

Disabling network boot where it is not needed and monitoring boot traffic and logs can reduce exposure while firmware updates are pending.