CVE-2026-97631 Vulnerability Found in UEFI TianoCore EDK II Firmware

Details have been disclosed regarding a critical vulnerability, tracked as CVE-2026-97631, in the open-source reference implementation of UEFI, known as TianoCore EDK II (EFI Development Kit II). This firmware is widely utilized across the majority of enterprise server motherboards.

• The vulnerability affects the TianoCore EDK II reference implementation.
• The root cause is located in the PXE driver during ICMP packet processing.
• Attackers can achieve arbitrary code execution without authentication.
• Enterprise servers, data centers, and cloud providers are at risk.

Vulnerability Details and Attack Mechanism

According to cybersecurity researchers, CVE-2026-97631 resides within the PXE driver and can be exploited by malicious actors sending specially crafted ICMP packets during network boot operations across IPv4 or IPv6 networks. Crucially, the attack requires no prior authentication, lowering the barrier for unauthorized system compromise.

The technical flaw stems from a classic buffer overflow within the ICMP message handler inside the UefiPxeBcDxe driver. This driver handles PXE booting and accepts ICMP packets to log network errors. Because incoming error messages are written to a fixed 504-byte buffer without validating the actual data size, sending payloads larger than 504 bytes causes memory corruption.

Impact and Scope

If more than 504 bytes are sent within an ICMP packet, the overflow spills past the buffer boundaries and overwrites adjacent memory structures. This enables an attacker to execute arbitrary code with UEFI firmware privileges during the pre-boot phase before handing control over to the operating system, bypassing UEFI Secure Boot protections.

Originally opened by Intel in 2004, the EDK II project serves as the foundation for firmware used by major vendors in servers, data centers, and cloud environments. Affected ecosystems include firmware built by AMI, Insyde, Phoenix, and Microsoft's Mu platform fork of EDK II.

Disclosure Timeline and Mitigation

CVE-2026-97631 was discovered by researchers from Anthropic and Google, with a coordinated public disclosure originally slated for January 2027. However, information leaked prematurely after an AMI engineer accidentally violated the embargo by publishing a public pull request containing the fix.

Server administrators and infrastructure providers are advised to apply the latest security patches immediately to protect against potential exploitation of this pre-boot vulnerability.