Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers

Summary: A buffer overflow in EDK II's PXE network-boot code, tracked as CVE-2026-97631 and rated 9.5 out of 10 by TianoCore, lets an attacker send one crafted ICMP error message longer than 504 bytes to overwrite memory during a network boot, with no password or prior access required. The flawed copy loop dates to a November 2010 commit and is present through edk2-stable202608, dated August 21; a fix reached the main development branch on October 15 but no stable release contains it, and the advisory lists no patched version.
What you should know: The patch has been public since a September 28 pull request disclosed the flaw by CVE number weeks ahead of a planned January 2027 disclosure, so skilled attackers can study it while server operators have nothing to install until their firmware vendor ships an update. HD Moore notes the bug could be used to hijack program flow while the boot process still has access to the TPM, breaking disk encryption for an attacker with short-term network access.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-97631
Related: ⚡ Weekly Recap: Critical CVEs, Linux DDoS Botnet, Device-Code Phishing, Android Spyware and More Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026