Most Servers on the Planet Are Vulnerable to This Firmware Code-Execution Flaw
A severe vulnerability with a 9.5/10 severity rating has been discovered in the TianoCore EDK II firmware code used by virtually all server vendors and data centers worldwide.
The vulnerability, tracked as CVE-2026-97631, is a memory-corruption flaw in an ICMP component that attackers can exploit to execute malicious code before the operating system and firmware can implement defenses like Secure Boot. While final payloads delivered by this exploit have no persistence, they can give attackers an opening to install other payloads that run each time during the early boot process.
The flaw resides in the PXE-Base Code driver (NetworkPkg/UefiPxeBcDxe), which allows servers and other devices to boot using code downloaded from a local network. The driver doesn't enforce a memory copy limit of 504 bytes, allowing attackers to send oversized ICMP error messages that overwrite adjacent data and corrupt the IUEFI module running on the CPU.
Botched Disclosure
The vulnerability was discovered by researchers Alex Matrosov of Anthropic and Dan Holmes of Google, who had arranged for it to stay under wraps until a coordinated disclosure scheduled for January. However, AMI, a hardware manufacturer, published a pull request last month that detailed the vulnerability and included a code fix. Once this became public, TianoCore Project members published a public advisory.
With publicly available patch code, it will be trivial for advanced hackers to learn how to trigger the vulnerability and build working exploits. Patching UEFI code vulnerabilities in millions of end devices is particularly cumbersome due to the involvement of thousands of hardware makers and cloud providers.
Exploitation Challenges
Exploiting CVE-2026-97631 requires some level of control over a local network, limiting exploitation to insiders or sophisticated attackers like nation-states who gain low-level network access. The vulnerability doesn't affect home and small office users who boot solely from disk drives.
For exploiting the vulnerability itself, an attacker needs to guess specific addresses within the target system, so it's not something that you can throw a single exploit at any target and get RCE across a diverse range of devices, but it needs to be tuned for each target model/version/configuration since the addresses will change based on those.
Vendor Responses
Intel stated that none of its "commercial products currently under security support" are known to be affected, though it acknowledged that OEM board vendors or system manufacturers may have integrated the affected EDK2 functionality. Arm responded that the vulnerability "is not directly applicable to Arm's product portfolio," though both companies' firmware implementations borrow heavily from EDK2.
Questions sent to AMD, Phoenix Technologies, AMI, Microsoft, and Amazon went unanswered when this report was published. Representatives from the TianoCore Project also didn't respond, leaving many questions about the full scope of affected devices and appropriate mitigation steps unanswered.
Related
