Critical Code-Execution Vulnerability Discovered in UEFI Firmware Endangering Global Servers

Image: Ars Technica · Source

A severe flaw in the TianoCore EDK II UEFI firmware used by most servers allows early-stage code execution, risking breaches before Secure Boot defenses activate.

A critical security vulnerability identified as CVE-2026-97631 has been found in TianoCore EDK II, an open source UEFI firmware implementation extensively used in servers worldwide. This memory corruption bug in the PXE-Base Code driver's ICMP component enables attackers to execute malicious code early in the boot process, before protections like Secure Boot and the Trusted Platform Module (TPM) can establish system integrity.

The flaw stems from a 16-year-old buffer overflow in the NetworkPkg\UefiPxeBcDxe module that processes ICMP error messages during network boot (PXE boot). Specifically, it fails to enforce a 504-byte limit when copying ICMP error data, allowing carefully crafted messages to overwrite memory and hijack CPU execution at ring 0 privilege level. This offers a pathway for attackers with network access—often insiders or advanced adversaries controlling segments of local networks—to inject and execute payloads during system startup.

Discovered by Alex Matrosov of Anthropic and Dan Holmes of Google, the vulnerability was originally scheduled for coordinated public disclosure in January 2027. However, an early disclosure by hardware maker AMI led to a public advisory. With exploit code potentially trivial to develop from the released patch, the risk of attacks on countless servers and cloud devices is heightened. Patching is challenging due to the vast install base, diverse hardware vendors, and the need for firmware updates.

Security experts note that this flaw compromises the early boot chain of trust, enabling attackers to bypass firmware attestation and potentially break disk encryption, especially during scenarios involving short-term network access or device theft. The issue is particularly dangerous because it occurs before the operating system and secure firmware components are fully operational.

Unlike other high-profile UEFI bugs such as LogoFail or BootHole, this vulnerability can be addressed by a code fix without dealing with Secure Boot key management or operating system updates. Still, the requirement to deploy BIOS/UEFI firmware updates across many devices remains a logistical challenge.

The vulnerability primarily impacts servers and enterprise equipment that use network booting with EDK II firmware. It does not affect typical home or small office users who boot exclusively from local drives. Major vendors like Intel and Arm state their current commercial products under support are not directly affected, though components integrating EDK II could carry risk. Queries to other major affected organizations have not received comment.

Given the severity and widespread use of the EDK II reference implementation, organizations operating network-boot-enabled servers are advised to verify their firmware versions, seek vendor guidance, and consider disabling network boot temporarily as a precaution. Maintaining enabled security features such as TPM and Secure Boot remains important despite not fully mitigating this specific threat. Monitoring for exploitation attempts through logging is also recommended.

This vulnerability underscores continuing risks in foundational firmware interfaces critical to global IT infrastructure security. It serves as a reminder of the complexity and challenges in securing early-stage boot environments amidst evolving threat landscapes.