EDK II PXE flaw permits code execution before Secure Boot
Critical EDK II flaw targets PXE-booting servers
TianoCore has disclosed CVE-2026-97631, a critical vulnerability in EDK II, the open-source firmware code widely used as a basis for UEFI implementations. Rated 9.5 out of 10, the flaw can let an attacker execute code before Secure Boot and other boot-time protections begin, provided the target is booting through PXE.
The issue affects EDK II through edk2-stable202608, released on August 21. The vulnerable code has been present since a November 2010 commit. PXE is enabled by default in EDK II's standard build, although the risk is limited to systems that boot from the network rather than a local disk.
That narrows the most relevant population to servers and data-centre equipment. Red Hat lists the affected edk2 package in Red Hat Enterprise Linux 8, 9 and 10 as affected and unfixed. SUSE and Debian have also marked their equivalent packages as affected.
Overflow occurs during network boot
The defect is a buffer overflow in EDK II's PXE network-boot driver. During a PXE boot, the driver receives ICMP error and status messages from network devices, then copies each message into a fixed 504-byte memory area. The length checks are incorrect in both the IPv4 and IPv6 paths.
An oversized message can therefore overwrite adjacent memory with attacker-controlled data. Sending one crafted error message to a machine during its network-boot window is sufficient to trigger the condition. No password or prior access to the target is required, but the attacker must be able to reach the system from an adjacent network position at that precise time.
A straightforward outcome is a boot failure or hang. Reliable code execution is more demanding: the advisory says an attacker needs knowledge of the exact firmware build to construct a counterfeit event and redirect execution. If successful, attacker code runs inside firmware before Secure Boot validates the startup chain.
Patch is in source, not yet in stable EDK II
A fix entered the EDK II main development branch on October 15. It truncates oversized messages at 504 bytes instead of allowing data to spill beyond the buffer. However, no stable EDK II release yet includes the correction, and TianoCore's advisory still records the patched version as not currently available.
Microsoft's Project Mu has incorporated the fix into release branches and produced tagged builds on October 26. For most operators, remediation will depend on a firmware supplier delivering a BIOS or UEFI update built with the corrected code. The advisory provides no other workaround.
The issue was identified by Alex Matrosov of Anthropic and Dan Holmes-Mitra of Google. TianoCore published its advisory on October 22 after a public pull request exposed the CVE and fix ahead of a planned January 2027 coordinated disclosure. There was no indication of active exploitation, and CVE-2026-97631 was not listed in CISA's Known Exploited Vulnerabilities catalog as of October 27.
What infrastructure teams should do now
Organizations should inventory servers and appliances that use PXE, confirm whether network boot is required, and disable it where it is not. Teams should also monitor boot-time network traffic and logs for unusual ICMP activity while tracking firmware advisories from their system and board suppliers. The practical priority is to reduce PXE exposure now and schedule vendor-provided firmware updates as soon as they become available.