Critical 16-Year-Old UEFI Flaw Allows Code Execution Before Secure Boot on Network-Booting Servers

Vulnerability Details

A critical 16-year-old flaw has been discovered in EDK II, the open-source code used by most hardware manufacturers to build UEFI firmware. This vulnerability, tracked as CVE-2026-97631 and rated 9.5 out of 10, allows an attacker to execute code on a machine before its operating system loads, specifically when the machine is booting over a network.

Attack Vector

The flaw is a buffer overflow within EDK II's network-boot (PXE) code. During a PXE boot, the machine loads its startup image from the network. The PXE driver incorrectly handles ICMP error messages, copying them into a fixed 504-byte memory area without proper size checks. This allows a crafted message longer than 504 bytes to overwrite adjacent memory with attacker-controlled data.

An attacker needs to send a single crafted error message to the machine's address during its network boot window. No password or existing access to the machine is required. While the simplest outcome is a crash, an attacker with knowledge of the exact firmware build can potentially plant a "counterfeit event" to run their own code before Secure Boot and other startup defenses are active.

Impact and Scope

The vulnerability affects machines that utilize EDK II for UEFI firmware and are configured for network booting. Red Hat and SUSE, which ship the affected code, classify this as an adjacent network attack, meaning the attacker must be on the same local network segment as the target machine. The ability to run code at the firmware level before the OS or security features load poses a significant risk for affected systems.

Current Status

TianoCore, the project maintaining EDK II, published an advisory on October 22. A code fix exists, but it has not yet been incorporated into a stable release of EDK II. Consequently, there is no patched version available for most users to install at this time.