Cybersecurity administrators around the world are facing the repercussions of a new, highly critical code execution software vulnerability in the early boot-time phase, found in firmware used by the majority of server and data center vendors globally.
The vulnerability carries a severity rating of 9.5 out of 10 and is centered in TianoCore EDK II, an open-source codebase relied upon by hardware manufacturers and cloud service providers to develop UEFI firmware that operates during hardware boot sequences. Tracked as CVE-2026-97631, the vulnerability is a memory corruption flaw within the ICMP component that allows attackers to execute malicious code prior to operating system startup and the activation of protection mechanisms such as Secure Boot.
Exploitation Method and Technical Mechanism
The problem lies in the network boot driver code named PXE-Base Code, which is responsible for enabling devices and servers to boot using code downloaded over the local network. During this process, the driver uses a network listener tool to monitor ICMP errors without enforcing a memory copy limit exceeding 504 bytes. This allows an attacker with low-level local network access to send an error message exceeding the allowed limit, resulting in overwriting adjacent data and corrupting the UEFI module running on the CPU at the highest privilege level (Ring 0).
Why This News Matters and Its Practical Implications
The severity of the vulnerability lies in its ability to bypass the chain of trust before loading the trusted TPM kernel module and Secure Boot mechanisms, granting attackers a golden opportunity to elevate privileges or disable systems. However, practical constraints limit its ease of exploitation; the vulnerability requires the attacker to have prior access to the local network and guess specific addresses within the target system, meaning it does not affect ordinary users or devices that boot exclusively from local drives, but is limited to organizations that rely on network booting and use the EDK2 framework.
Researchers and firmware developers have rushed to provide necessary updates and guidance, recommending that organizations verify system vendors and apply software patches urgently, alongside considering temporarily disabling network boot features when not needed and monitoring logs for any exploitation attempts.