Code-execution flaw in UEFI firmware affects most servers on planet Earth - Ars Technica
A critical code-execution vulnerability in UEFI firmware (CVE-2026-97631) with a severity rating of 9.5 out of 10 affects most servers on Earth, potentially allowing attackers to break the chain of trust during boot.
The vulnerability resides in the TianoCore EDK II, an open source codebase used by virtually all UEFI suppliers including AMI, Insyde, and Phoenix to create firmware that runs during boot-up. While final payloads have no persistence, they can provide attackers an opening to install other payloads that run each time during early boot.
Premature disclosure
The vulnerability was discovered by researchers who had arranged for it to remain confidential until a coordinated disclosure in January. However, AMI published a pull request last month detailing the vulnerability and including a code fix. Once discovered, TianoCore Project members published a public advisory.
Technical details
CVE-2026-97631 is a 16-year-old buffer overflow in the PXE-Base Code driver responsible for allowing servers to boot using code downloaded from a local network. The driver doesn't enforce a memory copy limit of 504 bytes, allowing attackers to send oversized ICMP error messages that overwrite adjacent data and corrupt the IUEFI module.
Related
