EDK II PXE Flaw Could Enable Pre-Secure Boot Code Execution
Summary
CVE-2026-97631 is a buffer overflow in EDK II PXE network-boot code that can crash or, with build-specific exploitation, run code before Secure Boot. A fix is merged but not yet in a stable release; no exploitation is known.
Key points
- The flaw affects EDK II through edk2-stable202608 and is rated 9.5 out of 10 by TianoCore.
- During PXE boot, oversized IPv4 or IPv6 ICMP error messages can overflow a 504-byte buffer.
- An attacker must reach the machine over the network during network boot; code execution requires an exploit tailored to the firmware build.
- Code execution would occur in firmware before Secure Boot checks, but the flaw does not by itself provide a way into a network.
- The code fix is merged into EDK II's development branch, but no stable release includes it yet; firmware vendors must ship updates.
- Operators who do not need PXE can disable it to reduce exposure; the advisory lists no other workaround.
- No exploitation has been reported, and the flaw was not listed in CISA's Known Exploited Vulnerabilities catalog as of October 27.
Article Details
- Vulnerability Types
- Buffer overflow
- Severity
- Critical; TianoCore rated it 9.5 out of 10.
- Affected Versions
- EDK II versions up to and including edk2-stable202608
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux 10
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- partial
- Workarounds
- Disable PXE/network boot if it is not needed to reduce exposure.
MITRE ATT&CK
CVE
People
Alex MatrosovCredited by the advisory as one of the researchers who found the EDK II flaw.Dan Holmes-MitraCredited by the advisory as one of the researchers who found the EDK II flaw.HD MooreCreator of Metasploit and chief research officer at Dragos; described potential risks from exploiting the flaw on a nearby endpoint or server.Jesse MichaelPrincipal researcher at Eclypsium who commented on the firmware update and the nature of the fix.
Vendors
AmazonAMD, Phoenix Technologies, AMI, Microsoft, and Amazon did not answer the tech news site's questions before publication, and TianoCore did not respond either, so the status of their products remains unclear.AMDAMD, Phoenix Technologies, AMI, Microsoft, and Amazon did not answer the tech news site's questions before publication, and TianoCore did not respond either, so the status of their products remains unclear.AMIthe reference code that nearly every UEFI firmware vendor builds on, including the independent BIOS makers AMI, Insyde, and Phoenix, as well as Microsoft's hardened fork, Project Mu.ArmArm said the flaw "is not directly applicable to Arm's product portfolio." Both companies' own firmware draws on EDK II.DebianLinux distributions also ship the code. Red Hat lists its edk2 package in Red Hat Enterprise Linux 8, 9, and 10 as affected and not yet fixed, and SUSE and Debian mark their equivalent packages the same way.IntelHow many shipping products carry the vulnerable code is not known. Intel told Ars Technica that none of its "commercial products currently under security support" are known to be affected, and that it "does not includeMicrosoftfirmware vendor builds on, including the independent BIOS makers AMI, Insyde, and Phoenix, as well as Microsoft's hardened fork, Project Mu.Phoenix TechnologiesAMD, Phoenix Technologies, AMI, Microsoft, and Amazon did not answer the tech news site's questions before publication, and TianoCore did not respond either, so the status of their products remains unclear.Red HatRed Hat and SUSE, which both ship the affected code, rated the flaw as one an attacker exploits from an adjacent network position rather than across the open internet.SUSERed Hat and SUSE, which both ship the affected code, rated the flaw as one an attacker exploits from an adjacent network position rather than across the open internet.
Products
EDK IIA critical 16-year-old flaw in EDK II, the open-source code that most hardware makers use to build UEFI firmware, can allow an attacker to run code on a machine before its operating system loads, but only while theProject Muincluding the independent BIOS makers AMI, Insyde, and Phoenix, as well as Microsoft's hardened fork, Project Mu.Red Hat Enterprise LinuxLinux distributions also ship the code. Red Hat lists its edk2 package in Red Hat Enterprise Linux 8, 9, and 10 as affected and not yet fixed, and SUSE and Debian mark their equivalent packages the same way.