A memory-corruption bug in TianoCore EDK II, the open source code that most makers of UEFI boot firmware build on, can let an attacker run code before the operating system and Secure Boot load, Ars Technica reports. The flaw, CVE-2026-97631, is rated 9.5 of 10 and sits in the network-boot (PXE) driver, which copies incoming ICMP error messages into a fixed 504-byte field without enforcing the limit.

It was found by Alex Matrosov of Anthropic and Dan Holmes-Mitra of Google and was meant to stay secret until a coordinated disclosure in January, but a public code fix from AMI exposed it and TianoCore published an advisory.

The limits matter: an attacker must reach the machine during network boot, typically from inside the local network, and exploits must be tuned to each firmware build. Home and office users who boot from disk are not affected. Intel and Arm told Ars their own products are not directly affected; AMD, AMI, Phoenix, Microsoft and Amazon had not answered. Ars suggests asking the firmware maker for guidance and turning off network boot where possible.