A severe vulnerability in TianoCore EDK2, the open source firmware implementation used by nearly all server and hardware manufacturers, has been disclosed publicly. The flaw, identified as CVE-2026-97631 with a severity rating of 9.5 out of 10, is a memory-corruption issue in an ICMP component that permits attackers to execute arbitrary code during the boot process before operating system and firmware-level security measures can take effect.
The vulnerability was discovered by researchers at Anthropic and Google, who had coordinated a disclosure planned for January. However, the timeline accelerated when AMI published a pull request last month containing details and a fix. TianoCore Project members subsequently released a public advisory last week. The existence of publicly available patch code means advanced threat actors can now reverse-engineer the vulnerability and develop functional exploits.
The technical issue stems from a 16-year-old buffer overflow in the PXE-Base Code driver, which manages network boot functionality for servers and storage devices. The driver monitors for ICMP error messages but fails to properly enforce a 504-byte memory limit when copying received data. This allows a malicious actor with local network access to send oversized error messages containing attacker-controlled code, corrupting the UEFI module running on the CPU and achieving execution at ring 0, the CPU’s most privileged level.
Exploitation requires some degree of local network control but can be delivered through simple unicast messages to a target device’s IP address during the PXE boot sequence. The vulnerability is particularly concerning because exploits bypass security attestation processes and allow attackers to install persistent malware that loads before Secure Boot and Trusted Platform Module protections engage. Security researchers noted this represents a critical attack window for compromising system integrity, potentially compromising disk encryption and enabling unauthorized access to sensitive components.
Patching presents significant challenges across the technology ecosystem, as millions of devices manufactured by thousands of vendors require firmware updates. Given the widespread distribution and the technical barriers to rapid deployment, security experts anticipate the vulnerability will persist in many end-of-support systems indefinitely.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI