Skip to content
Hacker Posts

EDK II CVE-2026-97631: pre-boot overflow in the UEFI PXE driver

CVE-2026-97631 (CVSS 9.5) is a 16-year-old out-of-bounds write in EDK II's PXE network-boot driver. No stable firmware fix yet; disable PXE where you can.

Published 3 min read
cveuefiedk2advisory

TianoCore published advisory GHSA-99cj-7hg9-mp4m on 22 October for CVE-2026-97631, a pre-boot out-of-bounds write in EDK II's PXE network-boot driver. It is scored CVSS 9.5 (v4.0 vector AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H). EDK II is the open-source UEFI reference code that AMI, Insyde, Phoenix, and Microsoft's Project Mu build on, so the blast radius is most of the server firmware market. The flawed code dates to a 2010 commit — it has shipped for roughly 16 years.

What the bug does

The vulnerable component is NetworkPkg/UefiPxeBcDxe, the PXE Base Code driver. Per the advisory, the IPv4 and IPv6 ICMP error handlers (PxeBcIcmpErrorDpcHandle and PxeBcIcmp6ErrorDpcHandle) "copy each received message into the fixed 504-byte field Mode.IcmpError" with incorrect bounds checks, so an oversized message overflows the buffer (CWE-120/131/787). A single crafted ICMP message sent to a machine during a network boot triggers it — no authentication, no prior access. The code runs before Secure Boot and the rest of the boot-time chain.

A crash or boot hang is the easy outcome. Code execution is harder: the advisory notes an attacker must know the exact firmware build to plant a usable payload, and Red Hat and SUSE rate the flaw adjacent-network, not internet-exploitable. The realistic attacker is an insider or someone with an existing low-level foothold on the boot network.

Affected and patched

  • Affected: EDK II master as of 2026-09-14 and earlier. Red Hat lists edk2 in RHEL 8, 9, and 10 as affected and unfixed; SUSE and Debian also mark their packages affected. Intel and Arm say their products are not affected.
  • Fix: merged into EDK II main on 15 October as PR #13302, which truncates oversized messages at 504 bytes. The advisory's patched-version field still reads "Not patched currently" — no tagged stable release carries it yet. Microsoft's Project Mu pulled the fix and cut tagged builds on 26 October.
  • In the wild: no known exploitation; not in CISA KEV as of 27 October.

Action checklist

  1. Inventory machines that use PXE to boot — that is the only exposed surface.
  2. Disable PXE on systems that don't need it, and segment the provisioning VLAN so arbitrary hosts can't reach the boot network.
  3. Track your firmware vendor's advisories (Dell, HPE, Lenovo, Supermicro, and the IBV builds underneath); the fix requires a firmware update, which means a reboot.
  4. Watch boot-time network traffic and filter unexpected ICMP toward PXE clients until firmware ships.

Context

Credit goes to Alex Matrosov (Anthropic) and Dan Holmes-Mitra (Google), who also proposed the fix. Coordinated disclosure was set for January 2027 but was overtaken on 28 September when an EDK II pull request (#13200) described the flaw by CVE number in public — Ars Technica called it a botched disclosure. This is the same EDK II network stack that produced the 2024 PixieFail set of PXE flaws; the reference firmware's network code keeps being where pre-boot bugs live, and downstream patch latency remains the hard part.

Related stories