CriticalAPTCVE-2026-97631
Critical UEFI Firmware Flaw Could Expose Millions of Servers to Pre-Boot Code Execution
Cyber Security News·Source published ·1 min read
What happened?
A critical bug in open-source EDK II firmware lets a remote attacker run code on a machine before the operating system starts. The flaw is tracked as CVE-2026-97631. It sits in the network boot (PXE) driver and received a CVSS v4 score of 9.5. The advisory lists the NetworkPkg package in EDK II master as of September 14, 2026. EDK II is the reference code that many firmware makers use to build UEFI firmware, so the bug can reach servers, desktops, and laptops that boot over a network.
Key details
- A critical bug in EDK II's PXE driver lets a remote attacker execute code before the OS loads.
- The flaw is in the UefiPxeBcDxe driver which mishandles ICMP error messages during network boot.
- Servers are at highest risk because data centers use PXE for bulk installs and reprovisioning.
- The fix was merged publicly in pull request 13302 on October 15, 2026, before the advisory.
- The advisory credits Alex Matrosov of Anthropic and Dan Holmes-Mitra of Google for the discovery.
Affected
- EDK II master branch as of September 14, 2026, NetworkPkg package.
- UEFI firmware built from vulnerable EDK II code used in servers, desktops, and laptops.
Fixes and mitigations
- Vendors must ship the fix in their own firmware updates.
- Isolate PXE boot traffic on provisioning networks and block unexpected ICMP errors.
What to look for
- CPU exception in DXE core causing boot hang after receiving ICMP error.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.