UEFI Firmware Bug Could Expose Servers Worldwide to Code Attacks
WHO:
Ars Technica - HD Moore said the flaw could be used to “break disk encryption” if an attacker has short-term network access, and that it would be easier in a theft scenario.
Ars Technica - Jesse Michael is identified as a principal researcher at Eclypsium.
The Hacker News - Alex Matrosov of Anthropic and Dan Holmes-Mitra of Google found the flaw.
The Hacker News - EDK II is open-source code used by most hardware makers to build UEFI firmware; firmware vendors using it include AMI, Insyde, and Phoenix. Microsoft’s hardened fork is Project Mu.
The Hacker News - Red Hat and SUSE rated the flaw as exploitable from an adjacent network position, rather than across the open internet.
The Hacker News - Intel said none of its “commercial products currently under security support” are known to be affected and that it “does not include the affected EDK2 functionality in its reference code.” Intel said an OEM board vendor or system maker could add it.
The Hacker News - Arm said the flaw “is not directly applicable to Arm’s product portfolio.”
The Hacker News - Red Hat lists edk2 in Red Hat Enterprise Linux 8, 9, and 10 as affected and not yet fixed; SUSE and Debian also mark their equivalent packages affected.
The Hacker News - AMD, Phoenix Technologies, AMI, Microsoft, Amazon, and TianoCore had not responded to questions before publication.
Ars Technica - HD Moore, Metasploit creator and Dragos chief research officer, said an attacker could hijack program flow when the boot process still has access to sensitive components such as a device’s TPM.
WHAT:
The Hacker News - CVE-2026-97631 is a critical buffer overflow in EDK II’s PXE network-boot code, rated 9.5 out of 10 by TianoCore.
The Hacker News - The flaw can crash a network boot or, with an exploit tailored to the exact firmware build, let an attacker run code before Secure Boot and other startup checks.
The Hacker News - Code execution occurs in firmware and does not persist through reboot by itself, but could install other code that runs on later boots.
The Hacker News - No stable EDK II release includes the fix; the advisory lists the patched version as “Not patched currently.” Project Mu incorporated the fix into release branches and tagged builds.
Ars Technica - Researchers have not reported seeing exploitation; the flaw was not in CISA’s Known Exploited Vulnerabilities catalog.
WHERE:
The Hacker News - The flaw affects machines booting over a network, primarily servers and data-center equipment; home or office machines booting only from local disks are not affected.
Ars Technica - The flaw alone does not provide network access; likely attackers would be insiders or people with an existing low-level foothold on the local network.
WHEN:
The Hacker News - TianoCore published its advisory on October 22 and rated the flaw 9.5 out of 10.
The Hacker News - The fix reached EDK II’s main development branch on October 15; Project Mu tagged builds on October 26.
The Hacker News - EDK II’s newest stable version, edk2-stable202608, is dated August 21. The faulty code dates to a commit from November 2010.
The Hacker News - Disclosure had been planned for January 2027, but a public pull request on September 28 identified the flaw by CVE number and included the fix.
The Hacker News - The project’s release tags were checked on October 28; CISA’s catalog status was checked against its October 27 update.
WHY:
TechRadar - The flaw received a 9.5/10 severity rating, and full remediation is expected to take months.
Ars Technica - Code execution is serious because it occurs before Secure Boot and other boot-time defenses verify the system.
HOW:
Ars Technica - Ars advised operators to watch boot-time network traffic and logs for signs of attack attempts.
Ars Technica - Fuzzing projects launched after the January 2024 PixieFail disclosures did not detect this flaw.
The Hacker News - During PXE boot, the driver copies ICMP error and status messages into a fixed 504-byte memory area. Incorrect IPv4 and IPv6 size checks let messages longer than 504 bytes overwrite nearby memory.
The Hacker News - An attacker needs no password or existing machine access but must reach the machine during its network-boot window and send a crafted error message.
The Hacker News - The source-code fix truncates oversized messages at 504 bytes. Until firmware makers ship updates, operators can disable PXE if unnecessary; no workaround is listed.
Ars Technica - Jesse Michael of Eclypsium said the flaw “can be fixed with a basic code fix” and does not require certificate or key revocations.
The Hacker News - In January 2024, researchers disclosed PixieFail, nine flaws in the same network-boot code.
(UPDATED October 28, 2026 21:01 UTC)
A critical flaw in EDK II network-boot code could let an attacker run code in a device’s firmware before Secure Boot and other startup checks, and it carries a severity rating of 9.5 out of 10. The vulnerability affects systems that boot over a network, mainly servers and data-center equipment, and an attacker must reach the machine during its network-boot window; researchers have not reported seeing it exploited. No stable EDK II release includes the fix yet, so operators can disable PXE boot if they don’t need it and monitor boot-time network traffic and logs while waiting for firmware updates.
--
(UPDATED October 28, 2026 19:05 UTC)
A critical flaw in EDK II, the open-source firmware code used by many hardware makers, could let attackers run code during network boot before Secure Boot checks the system. The bug affects PXE boot, mainly on servers and data-center equipment, and requires an attacker to reach a machine during its network-boot window; researchers have not reported seeing it exploited, and home or office computers that boot only from local drives are not affected. There is no fix in a stable EDK II release yet, though Project Mu has incorporated one, and operators can disable PXE if it is not needed while waiting for firmware updates.