TianoCore EDK II: Out-of-bounds write in PXE driver allows pre-boot code execution
Summary
EDK II, the open source firmware base used by many UEFI firmware implementations, contains a pre-boot remote code execution flaw in its PXE network boot driver. Oversized ICMP error messages overwrite memory while a machine boots over IPv4 or IPv6 via PXE. An unauthenticated attacker who can deliver such a message to the client during PXE boot can execute code before the operating system and Secure Boot start, or stop the boot process.
Affected
- TianoCore EDK2 (NetworkPkg, PXE Base Code driver UefiPxeBcDxe), versions 0 up to and including edk2-stable202608
- Firmware and virtual machine images built on affected EDK2 code; exact vendor status is unknown.
Fixed in
Unknown. A fix exists in EDK II master (PR #13302) but no stable release contains it yet. The advisory lists the patched versions as "Not patched currently".
Workaround
- Disable PXE network boot on systems that do not need it, after confirming out-of-band access (BMC, iLO, iDRAC).
- Isolate PXE and provisioning networks.
- Systems that boot only from disk are reported as not affected.
Exploitation
- No in-the-wild exploitation reported.
- Not listed in CISA KEV (checked 28 October 2026).
- No public exploit found. The fix code is public, which may ease patch analysis.
- EPSS rates exploitation as unlikely (0.43%).
Our recommendation
- Inventory servers and devices with UEFI and PXE or network boot enabled.
- Disable PXE where it is not needed; where it is needed, restrict it to isolated provisioning VLANs.
- Ask server, BMC and firmware vendors for signed fixes and release dates, and apply them when available.
- Re-check the GHSA advisory and the NVD entry weekly until a fix is published.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (3 repositories)
slabbdev/uefi-pxe-cve-2026-97631 · Try2Take/CVE-2026-97631-PoC · RayanZiani/Bootjack
Research sources
- GitHub Security Advisory GHSA-99cj-7hg9-mp4m github.com
- oss-security mailing list: CVE-2026-97631 www.openwall.com
- Ars Technica: Code execution flaw in UEFI firmware arstechnica.com
- Brandefense: CVE-2026-97631 brandefense.io
- Rescana: EDK2 UEFI PXE preboot RCE www.rescana.com
- Cyber-Defence: CVE-2026-97631 www.cyber-defence.io
- The Hacker News: Critical 16-year-old UEFI flaw thehackernews.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 23:31.
Original description (NVD)
EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality, Integrity, and Availability.
NVD references (6)
- https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m
- http://www.openwall.com/lists/oss-security/2026/10/28/4
- https://arstechnica.com/security/2026/10/code-execution-flaw-in-uefi-firmware-threatens-most-servers-on-plane…
- https://github.com/microsoft/mu_basecore/pull/1989
- https://github.com/microsoft/mu_basecore/pull/1990
- https://news.ycombinator.com/item?id=50265393
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.