UEFI flaw in server firmware enables pre-OS code execution

A critical vulnerability in TianoCore EDK II, the open-source UEFI firmware codebase used by most server vendors, allows an attacker with local network access to execute code before the operating system loads, according to advisories from TianoCore and reporting by Ars Technica. The flaw, CVE-2026-97631, has a CVSS score of 9.5 and lives in the PXE-Base Code driver that handles network boot. A fix is available from AMI in a public GitHub pull request, but the disclosure came months before researchers had planned.

The bug is a 16-year-old buffer overflow in NetworkPkg/UefiPxeBcDxe. When a machine boots over IPv4 or IPv6, the driver listens for ICMP error messages and copies them into a 504-byte field called Mode.IcmpError. Both the IPv4 and IPv6 handlers fail to limit the copy, and the destination pointer advances incorrectly, so an oversized ICMP message "writes attacker-controlled bytes past the field," the TianoCore advisory says. An unauthenticated attacker who can deliver ICMP errors during PXE boot can corrupt DXE-phase memory and run code at ring 0 before Secure Boot or measured boot has verified the OS, according to the advisory. The final payloads have no persistence, meaning they run only once, but they can install other malicious components that run early in each boot.

Exploitation requires some control over the local network, such as an insider or a threat actor who has already gained low-level access inside a network, and there is no evidence the flaw provides initial entry from outside. Jesse Michael, a principal researcher at Eclypsium, told Ars Technica that an attacker must guess target-specific memory addresses, so an exploit "needs to be tuned for each target model/version/configuration" rather than working across a diverse range of devices. HD Moore, creator of Metasploit and chief research officer at Dragos, said the bug can "hijack program flow at a point where the boot process still has access to sensitive components, like the endpoint's TPM," which could help break disk encryption in a theft or short network access scenario. The flaw does not affect systems that boot only from disk drives or typical home and small-office computers, but it does affect servers and other devices that use EDK2-based firmware with PXE network boot enabled by default.

The disclosure happened early. Researchers Alex Matrosov of Anthropic and Dan Holmes of Google had planned a coordinated release in January, according to Ars Technica. AMI, a hardware vendor, published a GitHub pull request with vulnerability details and a fix last month, according to both Ars Technica and Security Affairs. TianoCore then issued a public advisory last week. With patch code public, attackers can study the fix to build exploits, and patching UEFI firmware across millions of end devices is cumbersome and time-consuming, according to Ars Technica.

Intel and Arm have said their own products are not directly affected, though Intel noted that OEM board vendors or system manufacturers may integrate the affected EDK2 functionality, and Arm's product portfolio is not directly applicable. AMD, Phoenix Technologies, AMI, Microsoft, and Amazon did not answer questions from Ars Technica by publication time, and TianoCore representatives also did not respond. Security Affairs reported that several other companies had not answered when its article was published.

Administrators should contact their firmware or system supplier for guidance and turn off network boot where possible, according to both publications. TPM and Secure Boot remain useful, but they do not stop this attack, and monitoring logs for suspicious activity is also advised.