Code-execution flaw in UEFI firmware threatens most servers on planet Earth
Summary
A memory-corruption flaw in the open-source TianoCore EDK II code can let attackers execute code during the UEFI boot process, before protections such as Secure Boot take effect. The flaw affects firmware built from the code, and public patch details may help attackers develop exploits while updates reach affected devices.Key Facts
- The vulnerability is tracked as CVE-2026-97631 and has a reported severity score of 9.5 out of 10.
- The flaw is a 16-year-old buffer overflow in EDK II’s PXE Base Code driver, which supports network booting.
- The vulnerable ICMP message-handling code does not limit a memory copy to 504 bytes, according to the article.
- An attacker with access to a local network could send a crafted ICMP error message to corrupt memory and execute code during boot.
- EDK II is used by major UEFI suppliers, including AMI, Insyde, and Phoenix, and by Microsoft’s Project Mu.
- The article says attackers could use access during boot to target sensitive components such as the Trusted Platform Module.
- AMI published a pull request containing vulnerability details and a code fix before the planned coordinated disclosure.
- The article says patching firmware across devices from many hardware makers and cloud providers can be difficult and time-consuming.
Read the Full Article
This is a fact-based summary from The Actual News. Click below to read the complete story directly from the original source.
