Critical 16-year-old UEFI flaw still lacks stable patched release
Anthropic and Google researchers disclosed CVE-2026-97631, a CVSS 9.5 flaw in the PXE network-boot driver of EDK II, code embedded in the UEFI firmware of most servers. During network boot, a single crafted ICMP packet can run code before Secure Boot checks; the flaw has been in the code since November 2010. A fix was merged into EDK II on October 15, but no stable release includes it; review network boot usage and track vendor BIOS/UEFI updates.
What happened
Anthropic and Google researchers disclosed CVE-2026-97631, a critical 16-year-old flaw in the base code used in most servers' firmware. An attacker with local network access can run code on a machine during network boot, before the operating system loads.
Why it matters
According to the researchers, almost all servers on earth ship with this code in their firmware. The attack runs before Secure Boot protections, can crash the boot or hand the machine to the attacker, and no stable patched release exists yet.
What to do
Identify which servers boot over the network (PXE) and disable that mode or restrict the boot network where possible. Press vendors for BIOS/UEFI updates with the fix, already merged upstream on October 15.
For the technical team
- CVE
- CVE-2026-97631
- Affected
- TianoCore EDK II (código embutido no firmware UEFI da maioria dos servidores) · TianoCore EDK II, with the flaw present in the code since November 2010. Per the researchers, EDK II ships in the UEFI firmware of most servers. Systems booting exclusively from local storage are not exposed through this attack path.
- Exploitation
- Sources report no exploitation in the wild and no public proof of concept; the flaw is disclosed with no stable patched release.
- Fix
- Fix merged into EDK II on October 15, but no stable release includes it. Server and motherboard vendors must integrate the patch and distribute BIOS or UEFI updates.
- Vector
- Buffer overflow in the EDK II PXE network-boot driver. The driver copies incoming ICMP error messages into a fixed 504-byte buffer without properly limiting their size. Exploitation requires local network access, a machine booting over the network, and knowledge of the target's firmware build; a single crafted ICMP packet runs code before Secure Boot and measured boot checks.
- More details
- Tracked as CVE-2026-97631, CVSS 9.5, in the code for 16 years. Disclosed by Anthropic and Google researchers. The crafted ICMP message can crash the firmware and stop the operating system from loading, or run attacker-controlled code in the pre-boot environment.
Timeline
New disclosure detail: the flaw is rated CVSS 9.5, sits in the PXE network-boot driver as it copies incoming ICMP error messages, and has been in the code since November 2010.
Press coverage confirms code execution is only possible during network boot; a fix remains pending.
New details: the flaw is 16 years old, executes code before Secure Boot checks via PXE boot, requires local network access, and no patched stable EDK II release is available yet.
Want the next updates in your inbox? Get the daily edition →
See all 4 updates
Anthropic and Google researchers disclosed CVE-2026-97631, which allows hijacking servers during network boot.
Sources 4 sources
- @IntCyberDigest @IntCyberDigest
- @TheHackersNews @TheHackersNews
- Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers The Hacker News
- @DarkWebInformer @DarkWebInformer
