[CLSTR]
API
< Back to all clusters
[TECHNOLOGY] · 12 sources

started · updated

Part of situation: Critical cybersecurity vulnerabilities in server software (2 clusters)

TianoCore EDK II UEFI vulnerability threatens global server infrastructure

TianoCore EDK II UEFI firmware CVE-2026-97631 PXE boot buffer overflow

A critical security vulnerability in the TianoCore EDK II open-source codebase has been discovered, affecting the UEFI firmware used by most major hardware manufacturers and cloud providers. Tracked as CVE-2026-97631, the flaw has been assigned a CVSS severity score of 9.5/10.

The vulnerability resides in the PXE-Base Code driver within the NetworkPkg/UefiPxeBcDxe package. It is caused by a buffer overflow that occurs when the driver processes ICMP error messages larger than 504 bytes. This allows an unauthenticated attacker with local network access to execute arbitrary code during the DXE phase of the boot process.

Because the exploit occurs before the operating system loads, it can bypass security mechanisms such as Secure Boot and measured boot. The flaw primarily impacts servers, storage equipment, and data center infrastructure that utilize the Preboot Execution Environment (PXE) to boot over a network. Devices that boot exclusively from local storage drives are not affected.

Researchers Alex Matrosov of Anthropic and Dan Holmes-Mitra of Google discovered the flaw. While a fix has been developed and merged into the upstream master, the patch must still be integrated by various firmware suppliers and hardware makers before it reaches most machines.

Entities

Alex Matrosov · Ami · Anthropic · Arm · EDK II · Google · Intel · Microsoft · TianoCore

Claims

What the coverage asserts, and how many sources carry each claim.

Sources

U.S. CISA adds Linux Kernel and Broadcom VMWare ESX flaws to its Known Exploited Vulnerabilities catalog [cybernoz.com]
Critical UEFI Flaw Can Run Code on Servers Before They Boot [www.breezyscroll.com]
Une faille d'exécution de code dans le firmware UEFI menace la plupart des serveurs à l'échelle mondiale - Sécurité [www.developpez.net]
Faille critique dans le firmware UEFI : comment résoudre un problème vieux de 16 ans ? [www.emarketerz.fr]
Firmware UEFI, embargo saltato per errore: la patch di una falla da 9,5 è già pubblica [www.hwupgrade.it]
PXE-Boot: 16 Jahre alte EDK-II-Lücke umgeht Secure Boot vor dem Systemstart [www.ad-hoc-news.de]
EDK II PXE Vulnerability Carries Critical 9.5 CVSS 4.0 Score [econotimes.com]
After PHP, another critical flaw puts server security at risk [www.newsbytesapp.com]
Critical UEFI vulnerability endangers massive numbers of servers around the world [researchsnipers.com]
UEFI-Blamage: 16 Jahre alter Code-Fehler bedroht IT-Sicherheit weltweit [www.bild.de]
Serious security issue in startup software for professional systems worldwide [dev.to]
Most Servers on the Planet Are Vulnerable to This Firmware Code-Execution Flaw [www.wired.com]