UEFI PXE boot flaw CVE-2026-97631 rated 9.5
A 16-year-old buffer overflow in TianoCore EDK II PXE boot code, tracked as CVE-2026-97631, can run attacker code before the OS loads, per Ars Technica.
The story in focus
Ars Technica reports that CVE-2026-97631, a 9.5-rated memory-corruption flaw in the TianoCore EDK II codebase, affects UEFI firmware built by suppliers including AMI, Insyde and Phoenix. The overflow sits in a PXE boot driver, and disclosure came after AMI published a pull request describing the flaw and a fix.
- The flaw is a buffer overflow in the NetworkPkg/UefiPxeBcDxe driver, which handles PXE network boot.
- Exploitation requires network access during PXE boot and knowledge of the target firmware build.
- A pull request from AMI describing the bug and a fix preceded the TianoCore public advisory.
- Intel and Arm said the issue was not directly applicable to their commercial products.
What the flaw is and how it runs
According to Ars Technica, CVE-2026-97631 is a 16-year-old buffer overflow in the PXE Base Code driver. During network boot the driver copies incoming ICMP error messages into a fixed field without properly bounding the copy, so an oversized message can overwrite adjacent memory with attacker-controlled bytes.
The report says the malicious error can be a single unicast sent during the PXE boot sequence. An attacker who knows the target firmware build can plant code that executes in the CPU's most privileged ring before the operating system and defenses such as Secure Boot and the TPM load. Ars describes delivered payloads as lacking persistence on their own.
Disclosure and vendor response
The report states the discovering parties, Alex Matrosov of Anthropic and Dan Holmes of Google, had scheduled coordinated disclosure for January. AMI then published a pull request last month detailing the vulnerability and a fix, prompting TianoCore Project members to issue a public advisory last week, per Ars.
Intel told Ars that none of its commercial products under security support are known to be affected and that it does not include the affected EDK2 functionality in its reference code, though OEMs may integrate it. Arm said the flaw is not directly applicable to its portfolio. Ars reports that questionnaires sent to AMD, Phoenix, AMI, Microsoft and Amazon went unanswered, and that TianoCore representatives did not respond.
Who is exposed and what to do
Ars reports the flaw does not affect devices that boot solely from disk, applying instead to organizations whose machines boot from local networks or internet-connected resources using the vulnerable code. Exploitation requires local network access, and the report cites no evidence the bug offers an initial entry into a network.
Eclypsium researcher Jesse Michael told Ars the exploit must be tuned for each target model, version and configuration, but that a basic code fix can address it through a BIOS or UEFI update. Ars advises checking with firmware makers for guidance and considering disabling network boot temporarily.
Does CVE-2026-97631 affect ordinary PCs?
Per Ars Technica, it does not affect home users or any devices booting solely from disk drives. It applies to organizations whose machines use PXE network boot with firmware built on the vulnerable EDK2 code.
Sources & further reading
Help keep the record accurate. Send a correction.
