UEFI firmware flaw lets network attackers hijack most servers during boot

Overview

Updated 1 hour ago

A 16-year-old bug in the firmware that boots most servers lets a network attacker run code before the OS or Secure Boot loads. The flaw sits in TianoCore EDK II, the open-source base behind virtually every UEFI firmware vendor and Microsoft's Project Mu.

Triggering it needs local network access and a target booting from the network, which data centers commonly leave on. With the fix now public, working exploits are trivial to build, and patching millions of devices across thousands of hardware makers will take years.

Why it matters

Attackers with local network access can hijack most servers before security loads, defeating Secure Boot, TPM attestation, and disk encryption.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

9.5/10

CVSS severity rating

The buffer overflow in the PXE Base Code driver's ICMP handling is rated 9.5 out of 10.

16 years

Age of the flaw

The vulnerable code has existed in EDK II for 16 years before disclosure.

Most servers

Scale of exposure

Virtually all UEFI suppliers, including AMI, Insyde, and Phoenix, use the vulnerable EDK II codebase.

504 bytes

Unenforced memory copy limit

The driver fails to enforce a 504-byte memory copy limit, allowing oversized ICMP messages to overwrite adjacent data.

Voices

Curated perspectives — historical figures and your fellow readers.

People Involved

Alex Matrosov

Security researcher at Anthropic, co-discoverer of CVE-2026-97631

Co-discoverer of the vulnerability

Dan Holmes

Security researcher at Google, co-discoverer of CVE-2026-97631

Co-discoverer of the vulnerability

HD Moore

Chief research officer at Dragos, creator of Metasploit

Commented publicly on exploitation scenarios

Jesse Michael

Principal researcher at Eclypsium

Commented on exploitability and patching

Organizations Involved

TianoCore Project

Open-source software project

Maintainer of the vulnerable EDK II codebase

Open-source maintainer of EDK II, the UEFI firmware implementation used by most hardware vendors.

AMI (American Megatrends)

Firmware and motherboard vendor

Published the pull request that broke coordinated disclosure

UEFI firmware vendor that published a pull request detailing CVE-2026-97631 with a code fix.

Intel Corporation

Semiconductor manufacturer

Says no supported commercial products known to be affected

CPU maker that stated none of its commercial products under security support are known to be affected, though its reference code references EDK2.

Arm Holdings

Semiconductor IP company

Says vulnerability not directly applicable to its portfolio

Processor designer that said CVE-2026-97631 is not directly applicable to its product portfolio, despite documented use of EDK2.

Timeline

2010 October 2026

5 events Latest: Today

Tap a bar to jump to that date

October 2026
Ars Technica publishes detailed report on the flaw
Today Publication

Ars Technica describes how the vulnerability works, which vendors are affected, and the challenges of patching.
Today
TianoCore issues public advisory
Disclosure

TianoCore Project members publish a public advisory on CVE-2026-97631 after the AMI pull request surfaced.
October 2026
September 2026
AMI publishes pull request revealing the flaw
Disclosure

AMI posts the vulnerability details with a code fix, breaking the scheduled January coordinated disclosure.
September 2026
2026
Researchers discover CVE-2026-97631
Discovery

Alex Matrosov and Dan Holmes find the memory-corruption flaw and arrange a coordinated disclosure for January 2027.
2026
2010
Vulnerable ICMP parsing code enters EDK II PXE driver
Origin

A buffer overflow in the PXE Base Code driver's ICMP error handling is introduced into the EDK II codebase, about 16 years before disclosure.
2010

Scenarios

Working exploits for CVE-2026-97631 appear in the wild

Likely Resolves by Q1 2027

Discussed by: Ars Technica, HD Moore, Jesse Michael

The article states that with publicly available patch code, it will be trivial for advanced hackers to reverse-engineer the flaw and build working exploits. Because the bug runs code before boot-time defenses load, exploitation could be used to break disk encryption or plant persistent payloads. The likeliest trigger is a well-resourced actor with network access targeting specific data centers.

Major UEFI vendors ship patched firmware

Likely Resolves by Q2 2027

Discussed by: Jesse Michael (Eclypsium)

Jesse Michael noted this flaw can be fixed with a basic code update, without the key management changes Secure Boot bypasses require. AMI, Insyde, and Phoenix all build from EDK II and can issue patched firmware, but distributing it across thousands of hardware models and getting data centers to deploy it is a multi-year process.

New UEFI bootkit exploiting the flaw is documented

Unlikely Resolves by Q2 2028

Discussed by: Security researchers, HD Moore

HD Moore said the bug could let attackers hijack program flow while the boot process still has access to the TPM, enabling attacks on disk encryption. A bootkit built on this flaw would follow the pattern of BlackLotus, which exploited firmware and bootloader weaknesses. No such malware has been reported, and the requirement for network boot and per-target tuning raises the bar.

Historical Context

3 moments from history that rhyme with this story — and how they unfolded.

January 2024

PixieFail (January 2024)

Six vulnerabilities in TianoCore EDK II's network and PXE boot functions were disclosed; the most severe allowed remote code execution during network boot.

Then

Firmware vendors across the ecosystem scrambled to ship patches, and some platforms remained exposed for months.

Now

The disclosure prompted multiple fuzzing projects aimed at surfacing other EDK II flaws, which apparently failed to find this 16-year-old bug.

Why this matters now

The same codebase and the same PXE boot surface that PixieFail exposed produced CVE-2026-97631, showing this class of firmware bug recurs despite scrutiny.

2023

LogoFail (2023)

Rendering bugs in logo images embedded in the UEFI firmware of nearly every hardware maker allowed attackers to subvert the chain of trust and install malicious components before the OS or Secure Boot ran.

Then

Hundreds of PC models were affected, and vendors issued firmware updates over many months.

Now

LogoFail became a landmark demonstration that pre-boot image parsing is a rich attack surface across the UEFI ecosystem.

Why this matters now

Like CVE-2026-97631, LogoFail gave attackers code execution before security defenses load, relying on EDK II's widespread use across hardware vendors.

July 2020