Critical EDK II flaw reaches servers before Secure Boot during PXE boot
TianoCore disclosed CVE-2026-97631 on October 22, describing a critical EDK II flaw that can let an attacker run code before Secure Boot on a machine performing a PXE network boot. The immediate impact is concentrated on servers and data-center equipment that boot from the network: there is a code fix, but no stable EDK II release containing it yet.
The vulnerability is a buffer overflow in EDK II’s PXE network-boot code. During the short boot window, the driver processes ICMP error messages and copies them into a fixed 504-byte memory area. Incorrect size checks in both the IPv4 and IPv6 paths allow an oversized message to overwrite adjacent memory.
An attacker does not need a password or existing access to the machine, but must be able to reach it over the network while it is actively booting through PXE. A crafted message can at least hang the boot. Reliable code execution is more difficult because the exploit must be tailored to the exact firmware build, according to the advisory’s description.
The timing makes the issue more serious than an ordinary boot crash: successful code execution occurs in firmware before Secure Boot and other startup checks have completed. The initial execution does not persist through a reboot by itself, but the evidence says it could be used to install code that starts on later boots.
Organizations should first identify systems that use PXE rather than assuming that every EDK II-based device is exposed. The flaw does not affect machines that boot only from a local disk. Red Hat lists its EDK II package in Enterprise Linux 8, 9 and 10 as affected and not yet fixed, while the status of firmware from several major vendors remains unclear in the supplied reporting.
The upstream fix changes the copy operation so oversized messages are truncated at 504 bytes. It reached EDK II’s main development branch on October 15, but the newest stable release checked on October 28 still predates the change. Microsoft’s Project Mu has incorporated the fix into release branches and produced tagged builds on October 26; for other systems, administrators must wait for the firmware maker to ship a BIOS or UEFI update.
Until a vendor update is available, the advisory lists no workaround. Operators who do not need PXE can disable network boot to reduce exposure, and the supplied reporting recommends monitoring boot-time network traffic and logs for attempted exploitation. There is no reported exploitation at present, and the flaw was not listed in CISA’s Known Exploited Vulnerabilities catalog as of the October 27 update.