A 9.5 Flaw in EDK II Lets an Attacker Run Code Before the Operating System Loads

CVE-2026-97631 published October 22, 2026; upstream fix merged October 15, 2026

A 9.5 Flaw in EDK II Lets an Attacker Run Code Before the Operating System Loads

Threats

NIST and the NIST Cybersecurity Framework (CSF 2.0)MITRE ATT&CK

A buffer overflow in the PXE network boot driver of TianoCore EDK II, the open-source reference implementation behind much UEFI firmware, lets an unauthenticated network attacker corrupt memory and potentially execute code before the operating system loads. Tracked as CVE-2026-97631 and rated 9.5 under CVSS v4, the flaw sits in the UefiPxeBcDxe driver's ICMP error handlers for IPv4 and IPv6, which copy incoming messages into a fixed 504-byte field with incorrect bounds handling; a single crafted ICMP error message sent to a machine while it is PXE booting is enough to trigger it. The reliable outcome is a crash and a hung boot; an attacker who knows the target firmware build can execute code in the DXE phase at Ring 0, before Secure Boot and TPM-based protections act. The CVE record lists EDK II up to edk2-stable202608 as affected, and the GitHub advisory is GHSA-99cj-7hg9-mp4m. TianoCore merged a corrective patch on October 15, but whether any given hardware vendor has shipped it in device firmware is a separate question, and the CVE record itself lists no fixed version.

Executives

This flaw lives below the operating system, in the code that runs before any of your endpoint tools start. The exposure concentrates where PXE boot is routine: data center provisioning, imaging labs, and recovery workflows. Ask which of your fleets actually network-boot, and who owns firmware updates for them, because the upstream fix existing is not the same as your devices carrying it.

CIO / CISO

Inventory PXE-enabled systems by site and vendor, and press each vendor for a dated firmware commitment for CVE-2026-97631 rather than accepting the upstream patch as closure. Until firmware lands, treat network isolation of provisioning segments as the control of record: PXE traffic should never share a segment with general user or server traffic.

Engineers

Disable PXE boot on machines that do not need it. On machines that do, restrict booting to an isolated provisioning network, filter unexpected ICMP error messages toward booting clients, and track your vendors' firmware releases against the October 15 upstream fix. Home and small office machines that boot only from local storage are not the concern here.

Everyone (non-IT)

Nothing here asks individual users to act, and a laptop that boots from its own drive is not exposed by this flaw. If your workplace images computers over the network, expect firmware updates and short boot delays while IT works through them.