Critical UEFI flaw exposes most servers to code execution risk

How the flaw works

A critical vulnerability, tracked as CVE-2026-97631, has been found in the TianoCore EDK II codebase. This open source software is used by nearly all major server vendors to build UEFI firmware, the low-level code that runs when a computer starts up. The flaw is a buffer overflow in the PXE-Base Code driver, specifically in how it handles ICMP error messages during network boot. If an attacker sends a specially crafted message longer than 504 bytes to a server during its PXE boot sequence, the code copies too much data into memory, overwriting nearby data and allowing the attacker to run their own code on the server's CPU (Ars Technica↗ (opens in a new tab)).

The attack works before the operating system or security features like Secure Boot and the Trusted Platform Module (TPM) are active. This means an attacker could bypass protections that normally prevent unauthorised code from running. The exploit does not persist after a reboot, but it can be used to install other malicious software that does.

Who is affected

According to the report, the flaw affects most servers and data centres worldwide. This is because almost all UEFI firmware suppliers, including AMI, Insyde, and Phoenix, use the vulnerable EDK II code. Even Microsoft's Project Mu, a hardened version of EDK II, included the affected component. The vulnerability is present in millions of devices from thousands of hardware makers and cloud providers.

How the attack worked

To exploit this flaw, an attacker needs some control over the local network. They must send a malicious ICMP error message to a server while it is booting over the network (PXE boot). The message can be sent from any network distance, but it must arrive during the short window when the server is listening for such messages. This limits the attack mainly to insiders or attackers who have already gained access to the network, such as advanced threat actors or ransomware operators. There is no evidence that this flaw can be used to break into a network from the outside.

The response

The flaw was discovered by researchers from Anthropic and Google, who had planned a coordinated disclosure for January. However, a hardware vendor, AMI, published a code fix on a public forum before the planned date. This led the TianoCore Project to release a public advisory. With the patch now public, it is easier for attackers to figure out how to exploit the flaw. Patching UEFI firmware is complex and slow, as it requires updates to be distributed by hardware makers to millions of devices.

Has this happened before?

UEFI and its related code have seen several serious vulnerabilities in recent years. Previous flaws like LogoFail and PixieFail also allowed attackers to run code early in the boot process, bypassing security checks. Despite efforts to find such bugs, this latest flaw went undetected for 16 years.