Critical Boot Vulnerability Exposes Servers Globally

A critical vulnerability, CVE-2026-97631, has been discovered in the TianoCore EDK II, an open-source boot-time firmware essential for most server vendors and data centers. This flaw, rated 9.5 out of 10, allows attackers to execute malicious code before operating system defenses like Secure Boot and the Trusted Platform Module (TPM) are active.

The vulnerability stems from a buffer overflow in the PXE-Base Code driver, which handles network booting. Attackers can exploit this by sending oversized ICMP error messages during the pre-execution environment boot, corrupting the UEFI module and enabling code execution at the highest privilege level (Ring 0).

Discovered by researchers from Anthropic and Google, the vulnerability's details and a code fix were inadvertently published early by AMI. This premature disclosure, followed by a public advisory from the TianoCore Project, means exploit code can be easily developed by advanced hackers. The challenge of patching millions of devices globally exacerbates the risk.

While exploitation requires some level of local network access, potentially limiting it to insiders or sophisticated attackers, the flaw could be used to break disk encryption or elevate system privileges. This vulnerability joins a list of persistent UEFI flaws, potentially becoming a 'forever' bug on unsupported systems.