UEFI Flaw: Boot-Time Code Execution Exploit Found

A critical vulnerability, CVE-2026-97631, with a 9.5/10 severity rating, has been identified in the TianoCore EDK II codebase. This open-source UEFI firmware component is extensively used by hardware makers and cloud providers, impacting most of the world's server vendors and data centers.

The memory-corruption flaw resides in an ICMP component, enabling attackers to execute malicious code before operating systems and firmware defenses like Secure Boot can activate. While final payloads are not persistent, they can facilitate the installation of other early-booting malware.

Discovered by researchers from Anthropic and Google, the vulnerability's details were inadvertently disclosed by AMI last month. This premature disclosure, followed by a public advisory from TianoCore Project members last week, means exploits could be developed easily by advanced hackers.

Exploiting CVE-2026-97631 requires attackers to have some level of control over a local network, making it a threat primarily for insiders or sophisticated attackers. The vulnerability, a buffer overflow in the PXE-Base Code driver, allows for code execution at the most privileged ring 0 level, potentially breaking disk encryption and other security measures.

This flaw joins a series of recent UEFI vulnerabilities, highlighting ongoing security challenges in boot-time firmware. Deploying patches for UEFI code across millions of devices is a complex and time-consuming task, making this a potentially persistent threat, referred to as a 'forever' bug.

While Intel and Arm have stated their core products are not directly affected, they advise customers to check with system manufacturers. The scope of the vulnerability's impact across various vendors remains unclear due to unanswered inquiries. Users are advised to check with firmware makers for guidance and consider disabling network boot capabilities if possible.