Loading vulnerability…
Pre-OS Remote Code Execution in EDK II PXE Base Code Driver
CVE-2026-97631 is an out-of-bounds write vulnerability in TianoCore EDK II's UefiPxeBcDxe PXE Base Code driver. During network boot, the IPv4 handler PxeBcIcmpErrorDpcHandle and IPv6 handler PxeBcIcmp6ErrorDpcHandle copy received ICMP error messages into the fixed-size, 504-byte Mode.IcmpError field without adequate bounds checking. The copy logic also advances the destination pointer by the cumulative copied length rather than the current fragment length. Crafted messages can therefore overwrite adjacent firmware memory, potentially causing a boot hang or arbitrary code execution in the pre-operating-system UEFI environment. EDK II master as of September 14, 2026, is identified as affected; exposure of downstream products depends on their inclusion and use of the vulnerable driver.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can compromise confidentiality, integrity, and availability through arbitrary code execution at firmware privilege level before the operating system loads. Memory corruption can also trigger a CPU exception in the DXE core and hang the boot process, disrupting provisioning, operating-system installation, and recovery. Exploitation does not inherently provide persistence. Specific claims of defeating cryptographic attestation or TPM-backed disk encryption are not established.
If you can’t patch tonight, do this now.
Disable PXE boot where it is unnecessary. Where network boot is required, isolate provisioning networks and restrict access to booting clients. Filter unexpected ICMP error traffic directed at PXE clients, accounting for both IPv4 and IPv6 while preserving required network functionality. Inventory firmware PXE settings through vendor management tools or out-of-band management interfaces to identify exposed systems.
Patch, then assume compromise.
Install a system or firmware vendor update that incorporates the upstream EDK II correction. Upstream pull request 13302 was merged on October 15, 2026; it adds destination-buffer bounds checks, corrects fragment pointer arithmetic, truncates oversized ICMP messages, and clears the destination buffer before copying. Firmware maintainers should incorporate this correction into affected builds. Downstream fixed firmware versions and availability are not established, so confirm coverage with the system manufacturer rather than assuming the upstream merge protects deployed devices.
No public exploits tracked yet. Mallory keeps watching.
29 sources tracked across advisories and community write-ups. News coverage will land here when it surfaces.
No news coverage yet. Advisories and community discussion only.