Critical Uefi Flaw Exposes Servers During Network Boot
A flaw in widely used EDK II firmware code can let attackers execute code before an operating system loads, though exploitation requires a precisely timed network message.
A critical vulnerability in code used to build UEFI firmware affects most servers, according to Wired and Ars Technica. Tracked as CVE-2026-97631, the flaw can allow code execution early in the boot process, before the operating system loads. Wired says it carries a severity rating of 9.5 out of 10.
Table of Contents
How the flaw works
Wired reports that the vulnerability is a 16-year-old buffer overflow in the PXE Base Code driver within TianoCore EDK II. Hardware makers and cloud providers use this open-source codebase to create firmware that runs as a machine starts. During a network boot, the driver listens for ICMP error messages. Its IPv4 and IPv6 handlers can copy an oversized message beyond a fixed 504-byte field, corrupting adjacent memory.
An attacker must send a crafted message while the target is in the PXE boot sequence. According to Wired, a unicast message can reach the target from any network distance if the attacker can address its IP at the right time. The message could cause the boot to hang; an attacker who knows the target’s firmware build could instead use the flaw to execute code in the UEFI environment at the CPU’s most privileged level.
Why the exposure is broad
Ars Technica describes the flaw as affecting most servers. Wired says virtually all UEFI suppliers, including AMI, Insyde and Phoenix, make extensive use of EDK II reference code. Microsoft’s Project Mu, a hardened fork of EDK II, also used code containing the vulnerable component. That reach does not mean every device is equally exposed at every moment: Wired’s described attack depends on a network-boot window.
The immediate code delivered through the vulnerability does not persist after it runs, Wired reports. It could, however, give an attacker an opportunity to install another payload that runs on later boots. Wired also says exploitation can occur before defenses such as Secure Boot take effect and can bypass attestation processes intended to establish that hardware is secure.
Disclosure and response
According to Wired, discoverers Alex Matrosov of Anthropic and Dan Holmes of Google had planned to keep the flaw private until a coordinated disclosure scheduled for January. AMI published a pull request last month that described the issue and included a fix. After the discoverers learned of that post, TianoCore Project members issued a public advisory last week.
Wired warns that publicly available patch code could help advanced attackers develop exploits, while distributing UEFI fixes across devices from many hardware makers and cloud providers is slow and cumbersome. For teams responsible for servers and data centers, the reports point to a firmware response that may extend beyond a routine operating-system update.
Sources
This story was compiled by AI from the reports below. Read the originals for the full details.