Key facts
- CVE-2026-97631 is a memory-corruption flaw in an ICMP component of EDK2 UEFI firmware.
- The vulnerability allows code execution before operating system and firmware defenses like Secure Boot load.
- Exploitation requires local network access and is likely limited to insiders or attackers with low-level network access.
- The flaw is a 16-year-old buffer overflow in the PXE-Base Code driver (NetworkPkg/UefiPxeBcDxe).
- Attackers can deliver a denial-of-service by causing the boot sequence to hang.
- Code runs in ring 0, the CPU's most privileged execution level.
A critical code-execution vulnerability, CVE-2026-97631, has been discovered in the TianoCore EDK2, an open-source codebase widely used by hardware makers and cloud providers for UEFI firmware. The flaw allows attackers with local network access to execute malicious code early in the boot process, potentially bypassing security measures like Secure Boot and TPM. The vulnerability was publicly disclosed after a code fix was inadvertently published, making it easier for advanced hackers to develop exploits. Patching millions of devices is expected to be a time-consuming and complex process.