TianoCore has disclosed a critical buffer overflow in EDK II, the open-source UEFI firmware code used by many computer and server vendors. Tracked as CVE-2026-97631, the flaw carries a CVSS v4.0 score of 9.5 and affects the PXE network-boot driver.
While a machine is booting over IPv4 or IPv6, an unauthenticated attacker who can send it a crafted ICMP error message may trigger an out-of-bounds write in a fixed 504-byte buffer. TianoCore says the corruption can hang the boot process and, when an attacker knows the target firmware build, may allow code execution in the UEFI DXE phase before the operating system loads or Secure Boot and measured boot verify OS components.
The exposure is tied to the network-boot window, not ordinary use of a machine that has already started from local storage. EDK II is a shared firmware codebase, but the affected models and firmware versions depend on how each vendor integrated it. TianoCore’s advisory still lists no patched stable EDK II release, although the upstream fix was merged on October 15. Supermicro has separately published BIOS fixes for selected systems in its model-specific advisory.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
