Do Son 
TL;DR
TianoCore disclosed a critical EDK II PXE vulnerability (CVE-2026-97631) rated 9.5 on the CVSS v4.0 scale. Discovered by researchers Alex Matrosov of Anthropic and Dan Holmes-Mitra of Google, the flaw allows unauthenticated network attackers to execute arbitrary code during network boot before the operating system loads. Firmware developers and system administrators must apply patch pull request #13302 or restrict PXE boot environments immediately.
- CVE: CVE-2026-97631
- CVSS: 9.5 (Critical · CVSSv4)
- Product: TianoCore EDK2
- Affected: ≤ edk2-stable202608
- Impact: Pre-boot RCE in EDK II PXE driver
- Status: No confirmed exploitation yet
- EPSS: 0.5% (30-day)
- Action: See vendor advisory
Why It Matters
TianoCore EDK II is the open-source reference implementation of the Unified Extensible Firmware Interface (UEFI) specification. While exact affected device counts are not specified in the advisory, EDK II code forms the foundation of UEFI firmware across millions of enterprise servers, workstations, and virtual machines worldwide.
Because this EDK II PXE vulnerability triggers during the Driver Execution Environment (DXE) phase, an attacker can achieve ring 0 code execution before Secure Boot or measured boot verifies any operating system component. Currently, no public proof-of-concept exploit exists, and no active exploitation in the wild has been confirmed.
How the Attack Works
According to the security advisory, the flaw resides in the PXE Base Code driver (NetworkPkg/UefiPxeBcDxe).
Out-of-Bounds Write via ICMP Error Messages
During an IPv4 or IPv6 network boot, the driver keeps an open receive request for ICMP error messages and copies each incoming packet into a fixed 504-byte buffer named Mode.IcmpError. However, both PxeBcIcmpErrorDpcHandle and PxeBcIcmp6ErrorDpcHandle contain flawed copy loop bounds checks (CWE-120, CWE-787). When a unicast ICMP error message exceeds 504 bytes, the driver continues copying data and advances the destination pointer by the cumulative length rather than the per-fragment length.
Consequently, an oversized packet writes attacker-controlled bytes past the buffer, causing a deterministic CPU exception and boot hang on the next ICMP error. Furthermore, an attacker who knows the target firmware build can plant a counterfeit event in the packet so CoreSignalEvent() dispatches arbitrary code in the DXE phase.
Affected Versions
This EDK II PXE vulnerability affects NetworkPkg in the EDK II master branch as of September 14, 2026, and no official stable release is marked as patched in the advisory metadata.
Patch and Mitigation Steps
The maintainers published a source code fix in GitHub pull request #13302. Firmware vendors and builders must integrate this patch into their EDK II trees immediately, while administrators should disable PXE network boot on untrusted networks or isolate provisioning VLANs.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
