Summary
A critical, 16-year-old buffer overflow in EDK II, the open-source code most hardware makers use to build UEFI firmware, can let an attacker run code before the operating system loads. It is only reachable while a machine is booting over the network (PXE). TianoCore rated the flaw 9.5 out of 10 in advisory GHSA-99cj-7hg9-mp4m, published October 22. It is tracked as CVE-2026-97631.
Technical Details
| Field | Detail |
|---|---|
| CVE | CVE-2026-97631 |
| Component | EDK II PXE network-boot code |
| Affected | Up to and including edk2-stable202608 |
| Root cause | ICMP error messages copied into a fixed 504-byte buffer; size checks are wrong in both IPv4 and IPv6 code |
| Introduced | November 2010 commit |
| Researchers | Alex Matrosov (Anthropic) and Dan Holmes-Mitra (Google) |
The attacker needs no password or prior access, only the ability to send one crafted message to a machine during a network boot. Crashing the boot is easy. Code execution is harder and requires knowing the exact firmware build, but it would run before Secure Boot checks. PXE is enabled by default in EDK II's standard build, so servers and data center hardware are the main concern. Red Hat and SUSE rate it as exploitable from an adjacent network.
Patch Status
- A fix was merged into the main development branch on October 15 (PR 13302).
- As of October 28, no stable EDK II release contains it, and the advisory lists it as "Not patched currently."
- Microsoft's Project Mu has already included the fix in tagged builds.
- A public pull request on September 28 described the flaw and its fix, which pulled the advisory forward from a planned January 2027 date.
There is no known exploitation, and the flaw was not in CISA's KEV catalog as of October 27.
Recommendations
- Disable PXE/network boot in firmware on systems that do not need it.
- Keep PXE boot traffic on isolated, trusted provisioning VLANs.
- Monitor boot-time network traffic and logs for malformed ICMP messages.
- Track your hardware vendors' firmware advisories and apply updates once they ship the EDK II fix.