Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers

A critical 16-year-old security vulnerability in EDK II, the open-source reference code used to build UEFI firmware across the industry, could allow an attacker to execute arbitrary code prior to operating system loading and before Secure Boot defenses engage. However, this risk is specifically limited to network-booting machines during the brief PXE boot window.

According to an advisory published by TianoCore on October 22 and tracked as CVE-2026-97631, the flaw carries a severity score of 9.5 out of 10. The issue stems from a buffer overflow in the network-boot (PXE) code present in both IPv4 and IPv6 implementations. Specifically, the PXE driver improperly handles bounds checking when copying incoming ICMP error messages and status messages into a fixed 504-byte memory region, allowing specially crafted messages exceeding this size to overwrite adjacent memory.

Practical Implications and Attack Requirements

• Network Access Required: The vulnerability can only be exploited by an actor who can reach the target machine over an adjacent network during the network boot sequence. It is not exploitable directly across the open internet.
• No Password Needed: An attacker requires no prior access or credentials to target the device, though precise timing during the network boot window is critical.
• Limited Persistence: Code executed through this flaw runs inside the firmware and does not natively survive a system reboot, though a single successful execution could theoretically plant persistent components.
• Impact on Servers: Home and office users booting from local disks are unaffected. The issue primarily concerns organizations utilizing network-booted servers and data center equipment.

Status of Fixes and Verification

A code fix has been merged into the main development branch of EDK II to truncate oversized messages at 504 bytes, and Microsoft's Project Mu has incorporated the fix into tagged builds. However, as of late October, no stable release of EDK II containing the patch has been published, and affected Linux distributions—including Red Hat, SUSE, and Debian—list their packages as currently unfirmed. Industry responses remain mixed, with Intel and Arm indicating their direct product portfolios may not be directly affected, while several other vendors have not clarified their status.

Operators wishing to verify or mitigate exposure can disable PXE network booting if it is not required for their infrastructure, monitor boot-time network traffic and logs for anomalies, and consult official advisories from TianoCore and their respective firmware or hardware vendors for upcoming stable updates.