EDK II Flaw Rated 9.5 Can Expose PXE-Booting Systems to Code Execution

TianoCore disclosed a critical flaw in EDK II firmware that can let an attacker run code during network startup, before Secure Boot checks and the operating system load. The vulnerability, CVE-2026-97631, has a CVSS severity score of 9.5. The defect is in EDK II’s PXE network-boot driver. The component stores ICMP error data in a 504-byte buffer, but its size check can fail to reject longer packets, allowing excess data to overwrite nearby memory. An attacker does not need credentials, but must get a crafted ICMP packet to the target during the brief PXE startup window.

Source: TokenPost