This flaw resides in TianoCore EDK II, an open-source codebase utilized by hardware manufacturers and cloud providers to construct the UEFI firmware executed during system startup. The vulnerability, designated CVE-2026-97631, is a memory-corruption issue within an ICMP component.
Attackers can exploit this flaw to execute malicious code before operating system and firmware defenses, such as Secure Boot, can establish a chain of trust involving the Trusted Platform Module (TPM). Although the initial payloads delivered by CVE-2026-97631 lack persistence, they offer an opportunity for attackers to deploy other payloads during the early boot process.
The vulnerability stems from a 16-year-old buffer overflow located in the PXE-Base Code driver (NetworkPkg/UefiPxeBcDxe). This driver manages network booting, and its failure to enforce a 504-byte memory copy limit allows an oversized error message to overwrite adjacent data when monitoring ICMP errors.
HD Moore, creator of Metasploit and chief research officer at security firm Dragos, stated, “This vulnerability in the ICMP parser of the EDK2 network stack is interesting in terms of how it affects the chain of trust and the broader ecosystem.” He noted that an attacker could use this bug to hijack program flow while the boot process still accesses sensitive components, potentially breaking disk encryption if the attacker has short-term network access.
The discovery of CVE-2026-97631 was reported by Alex Matrosov of Anthropic and Dan Holmes of Google, who arranged for a coordinated disclosure scheduled for January. AMI, a hardware maker, published a pull request last month detailing the flaw and including a code correction.
This vulnerability is relevant to operators managing infrastructure that relies on network booting, as it affects systems that use EDK2 and have PXE functionality enabled by default. The ubiquity of CVE-2026-97631 suggests it may be a "forever" bug in end-of-support systems, according to Moore.
This incident highlights the persistent challenge in maintaining the integrity of foundational platform software, where flaws in widely adopted reference implementations can undermine established security mechanisms across vast fleets of deployed hardware.
