Security researchers have identified a critical code-execution vulnerability in TianoCore EDK II, an open source firmware implementation used by virtually all major server and hardware vendors to create UEFI code that executes during system boot. The flaw, designated CVE-2026-97631 and rated 9.5 out of 10 in severity, exists in a network boot component and can be exploited to run malicious code in a computer’s most privileged execution mode before the operating system and security mechanisms like Secure Boot become active.
The vulnerability resides in the PXE-Base Code driver, which handles network boot functionality for servers and other devices. The driver contains a 16-year-old buffer overflow that fails to properly limit memory operations when processing ICMP error messages during the pre-execution environment boot phase. An attacker with access to a target device’s local network can send a specially crafted error message exceeding 504 bytes to corrupt the UEFI firmware running on the CPU and inject malicious code that executes with ring 0 privileges.
The flaw was discovered by researchers at Anthropic and Google and was scheduled for coordinated disclosure in January. However, the vulnerability became public prematurely when a hardware manufacturer published patch code last month, followed by a public advisory from TianoCore Project members last week. The premature disclosure is significant because publicly available patch code can enable attackers to develop working exploits.
Repair of this vulnerability presents substantial challenges across the technology industry. Because UEFI firmware is integral to boot processes across millions of devices from thousands of hardware makers and cloud providers, patching requires coordinated efforts and extended deployment timelines. Security experts note the vulnerability is likely to persist indefinitely in many end-of-support systems. Exploitation requires network-level access to affected devices but can enable attackers to bypass attestation processes and install persistent malicious components that execute before standard security defenses load.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI