Security researchers have disclosed a critical vulnerability in TianoCore EDK II, an open source firmware implementation used by virtually all major UEFI suppliers to create boot-time firmware for servers and data centers worldwide. The flaw, designated CVE-2026-97631 and rated 9.5 out of 10 in severity, enables attackers to execute code during the boot process before operating system and firmware defenses like Secure Boot can be activated.
The vulnerability stems from a 16-year-old buffer overflow in the PXE-Base Code driver, specifically in the ICMP error message handling component. The driver allocates a fixed 504-byte field for ICMP error messages but fails to enforce proper bounds checking during memory copy operations in both IPv4 and IPv6 handlers. An attacker with low-level local network access can craft an oversized error message that writes malicious code past the allocated buffer, corrupting the UEFI module running on the CPU. The malicious payload runs at ring 0, the CPU’s most privileged execution level.
Experts including HD Moore, chief research officer at security firm Dragos, note the vulnerability poses particular risks because exploitation occurs before the boot process loads sensitive components such as the Trusted Platform Module (TPM), potentially enabling attackers to bypass disk encryption and compromise system integrity. The flaw was discovered by researchers Alex Matrosov of Anthropic and Dan Holmes of Google, who had coordinated a disclosure deadline scheduled for January. However, the vulnerability became public following a pull request published last month that included patch code details.
The premature disclosure complicates remediation efforts significantly. With publicly available patch code now accessible, advanced attackers can readily determine exploitation methods and develop working exploits. Additionally, patching UEFI vulnerabilities across millions of devices sold by thousands of hardware makers and cloud providers presents substantial logistical challenges. Moore warned the vulnerability will likely persist in end-of-support systems indefinitely, creating ongoing security concerns across the industry.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI