TianoCore disclosed CVE-2026-97631 in EDK II, an open-source UEFI development kit used by firmware vendors. The advisory describes a buffer overflow in the pre-boot PXE network path. Whether a product is exposed depends on its firmware build and configuration; the advisory does not mean every UEFI computer is vulnerable.
What TianoCore disclosed
The TianoCore GitHub advisory describes how ICMP packet processing in the PXE base code can lead to a buffer overflow. The vulnerability occurs before an operating system starts, so normal operating-system protections may not yet be active at that stage.
Ars Technica, The Hacker News and TechRadar reported on the advisory and its possible reach. TianoCore’s record is the source for the technical details. Vendor-specific firmware determines whether affected code is present in a shipping device.
Exposure depends on implementation
EDK II is used as a foundation by multiple firmware projects and manufacturers. A downstream vendor may incorporate, modify, or exclude components, and may enable or disable network boot. A device is not confirmed affected simply because it uses UEFI or a product family has used EDK II.
The vulnerable path is active while a machine is PXE-booting over IPv4 or IPv6. An unauthenticated attacker who can deliver a unicast ICMP error message to the client’s IP can trigger it; TianoCore says the attacker can be at any network distance. Organizations should verify the exact model and firmware with the device manufacturer.
Why pre-boot flaws matter
Firmware handles startup before the operating system and its endpoint tools load. A successful flaw in that environment can undermine the trustworthiness of the boot process or allow code execution at a privileged stage. The advisory’s technical scenario should be read with its prerequisites; a headline about widespread potential exposure is not a confirmed count of vulnerable or compromised systems.
PXE is often used for imaging and remote provisioning. If not needed, disabling it removes this exposure. If required, filter relevant ICMP errors to PXE clients where possible. TianoCore says the attacker can be at any network distance, so segmentation alone may not prevent delivery.
Actions for administrators
Inventory hardware models, firmware versions, and network-boot settings. Check the manufacturer’s advisory and update schedule for CVE-2026-97631 rather than applying an unrelated EDK II source patch directly to production firmware. Filter relevant ICMP errors to PXE clients where possible while vendor fixes are being evaluated.
For high-risk systems, document which machines boot from network and who can reach those segments. Test vendor firmware updates in a controlled group before broad deployment, and confirm the resulting firmware version on the device.
What remains to be confirmed
The TianoCore advisory lists EDK II master as affected and says it is not patched upstream yet. It does not enumerate every downstream product containing the code. Check vendor advisories and firmware versions for product exposure and backported fixes; broad potential reach is not a verified inventory of affected fleets.
The connection to Soclyde
Firmware security is distinct from password storage. Unique credentials can protect management accounts, but do not patch pre-boot code. Soclyde stores an encrypted vault on users’ devices rather than in a centralized cloud vault operated by Soclyde. See our guide to local and cloud password storage.
Key points
CVE-2026-97631 affects a PXE path in EDK II while a vulnerable machine is booting over the network and can receive a unicast ICMP error. Check firmware and vendor fixes; network segmentation alone may not block the attack.
