Security researchers have identified a critical memory-corruption flaw in TianoCore EDK II, the open-source firmware codebase used by virtually all major UEFI suppliers to create boot-time firmware for servers and data centers worldwide. Tracked as CVE-2026-97631 and rated 9.5 out of 10 in severity, the vulnerability resides in an Internet Control Message Protocol component and can be exploited to execute arbitrary code during the boot sequence, before the operating system and security mechanisms like Secure Boot can establish defenses.
The flaw was discovered by Alex Matrosov of Anthropic and Dan Holmes-Mitra of Google, who had coordinated a disclosure timeline for later this year. However, a pull request published last month by AMI containing the vulnerability and its fix led to early public exposure. Following this disclosure, the TianoCore Project published an advisory last week, making detailed patch information available to the public. The vulnerability is a 16-year-old buffer overflow in the PXE-Base Code driver, which handles network booting for servers and storage equipment. The driver fails to enforce proper memory boundaries when processing ICMP error messages, allowing attackers on a local network to send oversized messages that overwrite adjacent data and corrupt the UEFI module running on the CPU.
Exploitation requires an attacker to have some level of access to the target device’s local network. The vulnerability can be leveraged for denial-of-service attacks or, when the attacker has knowledge of the target firmware version, to execute malicious code at the highest CPU privilege level before attestation and Trusted Platform Module protections activate. While payloads from this vulnerability do not persist across reboots, they can facilitate installation of additional malicious components that execute during each boot sequence, potentially compromising disk encryption and system integrity.
The widespread impact stems from the ubiquity of EDK2 in the industry—major hardware vendors including AMI, Insyde, and Phoenix base their UEFI implementations on this codebase, as does Microsoft’s hardened Project Mu fork. Security researchers have warned that patching UEFI vulnerabilities across millions of deployed devices from thousands of vendors is a time-consuming process, and this flaw is likely to persist in end-of-support systems indefinitely. The discovery adds to a growing catalogue of critical UEFI vulnerabilities, including LogoFail and PixieFail, which similarly targeted the boot-time security chain.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI