Critical UEFI Flaw Affects Global Servers

A code-execution vulnerability in UEFI firmware affects most servers on planet Earth. The flaw, tracked as CVE-2026-97631, carries a severity rating of 9.5 out of 10. It is a 16-year-old buffer overflow in the PXE-Base Code driver, specifically a memory-corruption flaw in an ICMP component. The flawed copy loop has been present in the code since a commit added in November 2010. Alex Matrosov of Anthropic and Dan Holmes-Mitra of Google discovered the vulnerability. Final payloads delivered by the flaw have no persistence and run only once.

A coordinated disclosure was scheduled for January 2027. The plan was overtaken on September 28 when an AMI engineer publicly described the flaw. AMI published a pull request detailing the vulnerability and including a code fix last month. TianoCore Project members published a public advisory on October 22. The flaw affects EDK II up to and including edk2-stable202608. Red Hat lists its edk2 package in Red Hat Enterprise Linux 8, 9, and 10 as affected and not yet fixed. A code fix exists, but no stable release of EDK II contains it yet.

Microsoft's Project Mu has pulled the fix into its release branches and cut tagged builds on October 26. Operators who do not need PXE can disable it to reduce exposure until a firmware update arrives.