Critical EDK II Flaw Enables Pre-Boot Code Execution During PXE Boot
Summary
CVE-2026-97631 in TianoCore EDK II can let an unauthenticated network attacker trigger pre-boot code execution during PXE boot by delivering ICMP error messages. A fix was merged, but no patched release had been issued.
Key points
- The buffer overflow in TianoCore EDK II is rated 9.5 out of 10 in the vendor advisory.
- During IPv4 or IPv6 PXE boot, an unauthenticated network attacker able to deliver ICMP error messages can overflow a buffer, corrupt DXE-phase memory, and execute code before the operating system loads.
- The code execution occurs before Secure Boot or measured boot verifies or measures operating-system components.
- TianoCore merged a fix adding boundary checks and truncating oversized packets on Oct. 15, but the advisory still said no patched release was available.
- Debian identified vulnerable package versions across its Bookworm, Trixie, Forky, and Sid releases.
Article Details
- Vulnerability Types
- Buffer overflow
- Severity
- Critical; rated 9.5 out of 10 by the vendor
- Exploitation Status
- unknown
- Exploit Availability
- unknown
- Patch Status
- partial