A critical 16-year-old flaw in EDK II, the open-source code used by most hardware makers to build UEFI firmware, allows attackers to run code before the operating system loads during a network boot.
The vulnerability or weakness
The flaw is a buffer overflow in EDK II's network-boot code, PXE, where a crafted message can overwrite nearby memory, potentially allowing an attacker to run their own code before Secure Boot.
| CVE | CVSS | Severity | In CISA KEV | KEV due date |
|---|---|---|---|---|
| CVE-2026-97631 | 9.5 | CRITICAL | No | - |
CVE data: NVD (nvd.nist.gov) and the CISA Known Exploited Vulnerabilities catalog.
Earlier attacks and coverage
- Adobe Fixes 8 Critical Campaign Classic Flaws Allowing Code Execution and Security Bypass (2026-10-28)
- PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw (2026-10-26)
- Microsoft Issues Emergency Patch Update for Critical .NET Buffer Overflow Flaw (2026-10-26)
- BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot (2026-10-24)
- BlackX UEFI Bootkit Bypasses Secure Boot on Patched Windows Systems Missing Revocations (2026-10-23)
Business impact
This vulnerability could lead to significant operational disruptions and security breaches, especially for organizations that heavily rely on network-booting servers, as it can bypass Secure Boot and other startup defenses.
Industries affected
This issue primarily affects data centers, cloud service providers, and organizations that frequently use network-booting servers for system management and deployment.
Users affected
Users of network-booting servers may be at risk if their systems are targeted by an attacker during the boot process, potentially leading to unauthorized code execution and compromising the security of their machines.
