Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers

Key Points:

• A critical 16-year-old buffer overflow flaw (CVE-2026-97631) in EDK II's PXE network boot code allows attackers on the local network to run code before the OS loads, potentially bypassing Secure Boot and other defenses.
• The vulnerability affects most hardware vendors using EDK II for UEFI firmware, including AMI, Insyde, Phoenix, and Microsoft's Project Mu, but only impacts machines booting over the network, primarily servers and data center equipment.
• A fix was merged into the EDK II source code in mid-October 2026, but no stable release or firmware update including the patch is yet available, leaving many users exposed until vendors release updates.
• Exploiting the flaw requires sending a crafted ICMP error message during the network boot process; no password or prior access is needed, but the attacker must be on the local network and the exploit is build-specific and less reliable for code execution.
• The flaw was publicly disclosed earlier than planned after a patch was inadvertently revealed in a public pull request; no known attacks have been reported so far, and disabling PXE boot is advised as a temporary mitigation.