CVE-2026-97631

CVE Enrichment

CVSS: 9.5 CRITICAL
EPSS: 0.48%
EPSS Percentile: 41.53%
CISA KEV: Not listed

Description

EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality, Integrity, and Availability.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: [email protected]
Published: 23-Oct-2026 00:17
Last Modified: 28-Oct-2026 23:17
EPSS Date: 2026-10-28
CWE: CWE-120, CWE-131, CWE-787

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:P /
                            PR:N /
                            UI:N /
                            VC:H /
                            VI:H /
                            VA:H /
                            SC:H /
                            SI:H /
                            SA:H /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

References

Last enrichment sync: 29-Oct-2026 02:01
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

the project behind EDK II, published an advisory on October 22 and rated the flaw, tracked as CVE-2026-97631, 9.5 out of 10. A code fix exists, but no stable release of EDK II contains it yet, and the advisory EDK II PXE Flaw Could Enable Pre-Secure Boot Code Execution

People (4)

MITRE ATT&CK (1)

Vendors (10)

Products (3)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.