Critical UEFI firmware flaw lets attackers run code before Secure Boot on network-booting servers

A critical flaw has been found in EDK II, the open-source code that most computer and server makers use to build their UEFI firmware, the software that starts a machine before Windows or Linux loads. The bug, tracked as CVE-2026-97631 and rated 9.5 out of 10, lets an attacker on the network run their own code while a machine is starting up over the network, before Secure Boot has checked anything.¹ The fix is written, but most machines will only get it through a firmware (BIOS/UEFI) update from their manufacturer, and those updates are not out yet.^{1, 2}

Reporting checked October 29, 2026.

Too long; didn’t read?

The flaw is in the part of the firmware that handles network booting (PXE). Computers that start only from their own disk don’t use that code during boot.^{1, 2}

Typical home and small-office PCs are not affected, according to Ars Technica. The main risk is to servers and company machines that boot over the network.²

There are no reports of attacks so far.³

Organisations should turn off network boot where it isn’t needed and install firmware updates as soon as their hardware maker releases them.^{2, 3}

What UEFI and network boot are

When you press the power button, the first software that runs isn’t your operating system but the firmware built into the motherboard, today almost always UEFI. It checks the hardware, then hands over to Windows, macOS or Linux. Secure Boot, a UEFI feature, checks that the operating system loader is genuine before it runs.

Many servers and company computers don’t start from their own disk. Instead they use PXE (Preboot Execution Environment) to download a start-up image from a server on the local network, which makes it easy to install or reset hundreds of machines at once. The flaw sits in exactly this network-boot code.^{1, 2}

What the flaw does

During a network boot, the PXE driver listens for ICMP error messages, small network messages that report delivery problems. According to TianoCore, the project that maintains EDK II, the driver copies each one into a fixed 504-byte space in memory but gets the size checks wrong, so a longer message spills over into the memory next to it.¹

The advisory describes two outcomes. A single crafted message can reliably crash the start-up so the machine hangs. And an attacker who knows the exact firmware build on the target can use the same message to run their own code with the processor’s highest privileges, “before Secure Boot or measured boot has verified or measured any OS component”.¹ The attacker needs no password, only the ability to send the message to the machine while it is network-booting.¹

The bug is about 16 years old.³ It was found by Alex Matrosov of Anthropic and Dan Holmes-Mitra of Google, who also supplied the recommended fix.¹

How serious is it?

Because EDK II is the base for firmware from AMI, Insyde, Phoenix and Microsoft’s Project Mu, the flaw reaches a very large number of servers.² Code that runs this early can slip past the protections that start later. HD Moore, chief research officer at the security firm Dragos, told Ars Technica that an attacker could hijack the boot while it still has access to sensitive parts such as the TPM security chip, which could be used to break disk encryption.²

There are real limits, though:

It only matters during a network boot. Machines that start only from their disk don’t use this code while booting. If network boot comes first in the boot order or is set as a fallback, the exposure returns on every restart.^{2, 4}
The attacker usually needs a foothold on the local network. Ars Technica says this points to insiders or attackers already inside a company network, and there is no sign the bug can be used to break into a network from outside.² Red Hat rates the attack as coming from an adjacent network.⁵
Taking over a machine needs a tailored attack. Jesse Michael of the firmware security firm Eclypsium told Ars Technica that an exploit has to be tuned to each model, version and configuration.²
Not every firmware includes the code. Intel told Ars Technica that none of its commercial products under security support are known to be affected, though device makers may have added the code themselves.²

Why the fix is slow to arrive

The researchers had planned to keep the flaw private until a coordinated disclosure in January 2027. On September 28, a public code change to EDK II, signed off by an AMI engineer, named the vulnerability and included a fix, which revealed it early.^{2, 6} TianoCore merged the fix on October 15 and published its advisory on October 22.^{1, 7}

That fix lives in the shared source code. EDK II’s latest stable release, edk2-stable202608, came out before the fix, and the advisory lists the patched version as “Not patched currently”.^{1, 3} Microsoft’s Project Mu has released builds with the fix, but for physical machines every firmware maker still has to build, test and ship its own BIOS/UEFI update.³ Linux distributions are also still working on it: Debian lists its edk2 packages, used for virtual machine firmware, as vulnerable, and Red Hat lists them as affected.^{5, 8} On the plus side, Michael says this is a plain code fix, with no security keys to revoke, unlike earlier Secure Boot bypasses.²

What you can do

At home: no action is needed for this flaw on a normal PC or laptop that starts from its own drive.² It’s still a good habit to install the BIOS/UEFI updates your computer maker offers, usually through its support app or Windows Update.
Turn off network boot where it isn’t used. On servers and company PCs that don’t need it, disable PXE in the firmware settings, or at least remove it from the boot order and fallback options.^{3, 4}
Watch for firmware updates. Check your server and PC makers’ security notices for CVE-2026-97631 and install their BIOS/UEFI updates when they arrive. Intel advises asking your system manufacturer for specific guidance.²
Update virtual machine firmware too. If you run virtual machines with UEFI firmware (OVMF), install your Linux distribution’s edk2 update once it is released.^{5, 8}
Protect the network boot path. Keep machines that network-boot on a separate, tightly controlled network, and watch boot-time network traffic for unusual ICMP messages.³

Critical UEFI firmware flaw lets attackers run code before Secure Boot on network-booting servers

What UEFI and network boot are

What the flaw does

How serious is it?

Why the fix is slow to arrive

What you can do

Sources

Was your email in a breach like this one?

Recent Posts

What UEFI and network boot are

What the flaw does

How serious is it?

Why the fix is slow to arrive

What you can do

Sources

Was your email in a breach like this one?

Keep reading

Tags

Recent Posts