A 16-year-old flaw in the firmware code most servers boot from leaks out months before its planned disclosure
Ars explains who is actually exposed (network-booting machines, not home PCs) and what admins can do while vendors stay quiet.
A memory-corruption bug in TianoCore EDK II, the open source code that most makers of UEFI boot firmware build on, can let an attacker run code before the operating system and Secure Boot load, Ars Technica reports. The flaw, CVE-2026-97631, is rated 9.5 of 10 and sits in the network-boot (PXE) driver, which copies incoming ICMP error messages into a fixed 504-byte field without enforcing the limit.
It was found by Alex Matrosov of Anthropic and Dan Holmes-Mitra of Google and was meant to stay secret until a coordinated disclosure in January, but a public code fix from AMI exposed it and TianoCore published an advisory.
The limits matter: an attacker must reach the machine during network boot, typically from inside the local network, and exploits must be tuned to each firmware build. Home and office users who boot from disk are not affected. Intel and Arm told Ars their own products are not directly affected; AMD, AMI, Phoenix, Microsoft and Amazon had not answered. Ars suggests asking the firmware maker for guidance and turning off network boot where possible.
-
UEFI
After exploring Code-execution flaw in UEFI firmware affects most servers on planet Earth - Ars Technica, what runs before your operating system is explained in UEFI.
UEFI is the firmware architecture that runs first when a computer powers on, before the operating system; TianoCore EDK II is one of its main implementations.
Wikipedia · Wade · 5 min
0 -
PXE boot
After exploring Code-execution flaw in UEFI firmware affects most servers on planet Earth - Ars Technica, the network-boot feature the bug lives in is covered in PXE boot.
PXE is a standard that lets a machine boot software fetched over the network, needing only a PXE-capable network card.
Wikipedia · Wade · 5 min
0