CVE-2026-97631: TianoCore EDK II UEFI PXE driver — 16-year-old buffer overflow allows pre-OS code execution during network boot
Severity: critical · Patch status: partial · Since 2026-10-28 · CVE-2026-97631
A critical 16-year-old buffer overflow (CVE-2026-97631, CVSS 9.5) in the PXE-Base Code driver of TianoCore EDK II was disclosed early when AMI published a fix ahead of the planned January disclosure. The IPv4/IPv6 ICMP error handlers copy messages into a fixed 504-byte field without enforcing bounds, letting an unauthenticated attacker on the local network (or able to reach the target during PXE boot) corrupt DXE-phase memory and execute arbitrary code at ring 0 before the OS loads and before Secure Boot or measured boot verifies anything. Code does not persist but can seed bootkit-style implants; invalid packets can also cause denial of service. Only systems that boot over the network with PXE enabled are affected; disk-boot and home users are not. Intel and Arm say their products are not directly affected, but OEMs may embed the vulnerable code; firmware updates across devices will take time.
What to do
- Contact your system/firmware vendor to determine whether your devices use EDK2-based firmware with PXE and obtain patched firmware
- Disable network (PXE) boot where not required
- Monitor logs for suspicious boot or network activity
- Do not rely on Secure Boot or TPM as mitigations — they do not stop this attack
Sources
All live incidents on Threat Watch
