Security researchers have identified a critical code-execution vulnerability in TianoCore EDK II, the open source UEFI firmware codebase used by the majority of server vendors and data centers worldwide. The flaw, designated CVE-2026-97631 with a severity score of 9.5 out of 10, resides in the ICMP component of the firmware and enables attackers to execute malicious code during the early boot sequence, before operating system and firmware defenses such as Secure Boot can be deployed.
The vulnerability stems from a 16-year-old buffer overflow in the PXE-Base Code driver, which handles network boot functionality for servers and storage equipment. The driver fails to properly enforce memory copy limits when processing ICMP error messages, allowing an attacker with access to a local network to send oversized messages that overwrite adjacent data and corrupt the UEFI module running on the CPU. Researchers Alex Matrosov of Anthropic and Dan Holmes-Mitra of Google discovered the flaw and had arranged for coordinated disclosure scheduled for January. However, after AMI published a pull request containing patch code and vulnerability details last month, TianoCore Project members released a public advisory, making it relatively straightforward for advanced attackers to develop working exploits.
The implications of this vulnerability are particularly serious because exploitation occurs at ring 0, the CPU’s most privileged execution level, before security mechanisms like the Trusted Platform Module can activate. Although malicious payloads do not persist after reboot, they create an opportunity for attackers to install additional code that executes early in the boot process on each subsequent restart. An attacker with low-level network access can deliver the malicious ICMP error message to a target device during the pre-execution environment boot phase. Security researchers note that the vulnerability could be weaponized to compromise disk encryption, particularly in scenarios involving short-term network access or physical theft.
The discovery of CVE-2026-97631 compounds existing challenges in the UEFI security landscape. It joins previously identified critical vulnerabilities including LogoFail and PixieFail, both of which exploited EDK2 flaws to subvert the chain of trust that UEFI is designed to enforce. Patching UEFI vulnerabilities across millions of devices manufactured by thousands of hardware makers and cloud providers presents significant logistical challenges, and security experts anticipate that this flaw will persist indefinitely in end-of-support systems. The vulnerability requires local network access to exploit, limiting its immediate attack surface, but its widespread presence in deployed infrastructure makes it a significant concern for defenders globally.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI