A critical vulnerability in UEFI firmware has been discovered, affecting most servers worldwide. The flaw, tracked as CVE-2026-97631, allows attackers to execute code during the early boot process—before operating systems or security features like Secure Boot load.
What Happened
The vulnerability was identified by Alex Matrosov of Anthropic and Dan Holmes of Google. It was initially kept under wraps for a coordinated disclosure scheduled for January.
After the disclosure was publicly shared, the TianoCore Project issued a public advisory. AMI, a major hardware vendor, published a pull request detailing the flaw and including a code fix.
The flaw resides in the TianoCore EDK II, an open-source codebase used by nearly all UEFI firmware suppliers. This includes major vendors like AMI, Insyde, and Phoenix. Microsoft’s Project Mu, a hardened version of EDK II, also used the vulnerable code.
The discovery process highlights the challenges of identifying and managing vulnerabilities in deeply embedded, long-standing open-source components. The researchers reportedly conducted extensive testing over several months, including targeted fuzzing and manual code analysis, to isolate the issue.
How the Vulnerability Works
The flaw is a memory-corruption issue in the ICMP error handler of the PXE-Base Code driver (NetworkPkg/UefiPxeBcDxe).
During network boot—when servers load operating systems from a network—the driver listens for ICMP error messages. It copies these messages into a fixed 504-byte buffer without enforcing a length limit.
When an oversized message arrives, the driver overwrites adjacent memory. This corruption allows attackers to inject malicious code into the UEFI firmware environment.
The malicious payload runs in ring 0, the most privileged execution level on a computer. This means it can access hardware and system resources directly, bypassing early security checks. The vulnerability is triggered during the pre-execution environment boot, a phase where the system has not yet loaded an operating system or initialized security modules such as Secure Boot or the Trusted Platform Module (TPM).
The attack vector is specifically tied to the PXE boot process, which is commonly used in data centers for deploying operating systems to servers via a network interface. This process involves a network listener that remains open during boot to receive error messages, and the flaw lies in the failure to validate the size of incoming packets before copying them into memory.
As the official advisory explains, the driver’s copy loop in both IPv4 and IPv6 handlers does not enforce a per-fragment length boundary. Instead, it advances the destination pointer by the cumulative length of the message, allowing oversized packets to overwrite memory beyond the -than 504-byte buffer. This behavior results in a buffer overflow that corrupts the IUEFI module running on the CPU, enabling execution of attacker-controlled code.
Why It Matters
Attackers can exploit this flaw to hijack the boot process before Secure Boot or the Trusted Platform Module (TPM) are active. These components are designed to verify the integrity of boot code and establish a chain of trust for all subsequent software execution.
Because the exploit runs early, it can break disk encryption, especially in theft scenarios where an attacker has temporary network access. For example, in a physical theft scenario, an attacker with access to a network-connected server could send a specially crafted ICMP error message during the boot sequence to trigger the vulnerability and install a payload that disables encryption on the drive.
HD Moore, creator of Metasploit and chief research officer at security firm Dragos, emphasized the significance of this vulnerability in terms of chain-of-trust disruption. He noted that the ability to execute code at this early stage undermines the fundamental security model of modern computing systems. ‘An attacker intent on compromising a nearby endpoint or server could use this bug to hijack program flow at a point where the boot process still has access to sensitive components, like the endpoint’s TPM,’ he said. ‘This could be used to break disk encryption for cases where an attacker has short-term network access (and it would be even easier in a theft scenario).’
Key Facts and Limitations
- This suggests that automated scanning tools may not have been effective in detecting such deep memory corruption issues in legacy code.
- It only affects systems that boot via network (PXE), not those using local disk drives. Home users and small office users are not at risk, as they typically boot from local hard drives and do not use PXE boot functionality.
- It requires precise knowledge of the target system’s firmware version and memory layout. The addresses used in the firmware are not static—they vary based on hardware configuration, firmware revision, and build version.
- Attackers must send a specially crafted ICMP error message during the boot sequence. This message must be delivered at the correct moment in the boot timeline, which is typically within the first few seconds after the system starts.
- There is no evidence that CVE-2026-97631 provides a direct entry point into a network. The vulnerability does not allow remote exploitation from outside the network; it requires either insider access or a compromised network segment.
Jesse Michael, a principal researcher at firmware security firm Eclypsium, explained that the exploit is not universal. ‘For exploiting the vulnerability itself, an attacker needs to guess specific addresses within the target system,’ he said. ‘So it’s not something that you can throw a single exploit at any target and get RCE across a diverse range of devices. It needs to be tuned for each target model/version/configuration since the addresses will change based on those.’
Unlike vulnerabilities like BootHole or BlackLotus, which required complex key management or revocation processes, this flaw can be fixed with a basic code patch. The fix requires a firmware update, but does not involve complex key revocation or OS-level changes. This makes it more manageable for vendors to address, though the scale of deployment remains a challenge due to the ubiquity of the affected codebase.
Who Is Affected?
The vulnerability applies only to organizations using servers or devices that boot from a network. This includes data centers, cloud infrastructure providers, and enterprise IT environments that rely on PXE boot for system provisioning.
Home users and small office users are not at risk, as they typically boot from local hard drives and do not use PXE boot functionality. Even in enterprise environments, only systems with specific firmware configurations that include EDK2 and the PXE driver are vulnerable.
Major vendors like Intel, AMD, and Arm have not confirmed whether their products are affected. Intel stated that none of its current commercial products under security support use the affected EDK2 functionality. However, it acknowledged that OEMs may integrate EDK2 into their systems. Intel’s public reference code includes EDK2, and its development kits are based on specific EDK2 revisions. This means that while Intel’s own products may not be directly impacted, third-party systems using Intel hardware and firmware may still be at risk.
Arm responded that CVE-2026-97631 is not directly applicable to its product line. Like Intel, Arm’s firmware relies heavily on EDK2. This indicates that while the vulnerability may not directly impact Arm-based systems, the underlying codebase still presents a shared risk across multiple hardware platforms.
Responses from AMD, Phoenix Technologies, Microsoft, and Amazon were not provided when this article was published. The TianoCore Project also did not respond to questions. This lack of transparency makes it difficult for organizations to assess their exposure and take appropriate action.
What Should Users Do?
Organizations using network boot capabilities should take the following steps:
- Check with their firmware vendor to determine if their systems use EDK2 and PXE functionality. This can be done by reviewing firmware documentation or contacting the vendor directly.
- Temporarily disable network boot if possible. This reduces the attack surface and prevents the vulnerability from being triggered during system provisioning.
- Ensure security features like TPM and Secure Boot are enabled. While these features do not prevent this specific attack, they help defend against other types of firmware tampering and provide additional layers of protection in other attack scenarios.
- Monitor system logs for signs of exploitation attempts. Look for unusual network traffic, particularly ICMP error messages, during boot sequences. Logs may show unexpected packet sizes or messages sent to the system during the early boot phase.
- Plan for firmware updates. Once the patch is released, organizations should schedule updates to ensure all systems are protected. This process may require coordination across multiple departments, including IT, operations, and security.
Experts caution that this flaw may be a ‘forever’ bug. It exists in many systems that have reached end-of-support, where updates are no longer provided. These systems may remain vulnerable indefinitely, especially if they are used in critical infrastructure environments.
What to Watch Next
As more systems are scanned, it will become clearer how widespread the vulnerability is. Researchers may discover additional flaws in EDK2 through ongoing fuzzing. The discovery of CVE-2026-97631 highlights the risks of relying on open-source firmware components with long-standing codebases that have not undergone rigorous, continuous security reviews.
Organizations should remain vigilant and consider conducting firmware audits. These audits should include a review of the underlying codebase, the presence of EDK2, and the use of PXE boot functionality. Regular audits can help identify potential exposure to similar vulnerabilities in the future.
For more details, see the original report at Wired.
Sources & further reading
Featured image: original publisher image. Via original publisher. Image source
