Code-execution flaw in UEFI firmware threatens most servers on planet Earth

A critical flaw rated 9.5/10, CVE-2026-97631, affects the EDK II open-source firmware code used by many server and hardware makers to build UEFI. In its PXE network-boot driver, a 16-year-old memory-copy bug lets oversized ICMP error messages overwrite data beyond a fixed 504-byte buffer. An attacker who can send traffic to a machine during network boot may exploit the corruption to run code at the processor’s highest privilege level, before the operating system and protections such as Secure Boot are active. This early access could expose sensitive components such as the TPM and help an attacker undermine disk encryption or establish further boot-time malware.

The risk is serious but not universal: affected systems must use EDK II and PXE network boot, so machines that boot only from disk are not exposed. Attackers need a foothold on the local network, and reliable code execution requires knowledge of the target’s firmware and configuration; the flaw is not a straightforward way into a network. Public patch code appeared before the planned coordinated disclosure, making exploit development easier while leaving organizations with a difficult firmware-update task across many vendors. The vulnerability can be fixed with a firmware update, without the complex key revocations required for some Secure Boot attacks. Organizations should ask system makers whether their firmware is affected, consider disabling network boot temporarily, and monitor for exploitation attempts.