Ethical Hacking News
A critical vulnerability has been discovered in the UEFI firmware, allowing an attacker to run code on a machine before its operating system loads. The vulnerability affects nearly every UEFI firmware vendor and has a fix in the works, but no stable release yet.
A critical vulnerability has been discovered in the UEFI firmware, allowing an attacker to run code on a machine before its operating system loads. The vulnerability is a buffer overflow in EDK II's network-boot code, known as PXE, which can be exploited to crash the machine's boot process or run code before Secure Boot and other startup defenses load. The affected code has been in the EDK II firmware since a commit added in November 2010. The vulnerability can be exploited over the network during the short window when the machine is booting this way, without the need for a password or existing access. Affected organizations include Red Hat, SUSE, and Linux distributions, which ship the code, although the status of their products remains unclear. To mitigate the risk, server operators are advised to disable PXE if they do not need it, and to watch boot-time network traffic and logs for signs of attempts.
A critical vulnerability has been discovered in the UEFI firmware, a software that runs on the boot process of computers, which can allow an attacker to run code on a machine before its operating system loads. The vulnerability, tracked as CVE-2026-97631, is rated 9.5 out of 10 by TianoCore, the project behind the EDK II firmware.
The vulnerability is a buffer overflow in EDK II's network-boot code, known as PXE, which can be exploited by an attacker to crash the machine's boot process or run their own code before Secure Boot and other startup defenses load. The attacker does not need a password or existing access to the machine, but must reach it over the network during the short window when it is booting this way.
The affected code is part of the EDK II firmware, which is used by nearly every UEFI firmware vendor, including independent BIOS makers AMI, Insyde, and Phoenix, as well as Microsoft's hardened fork, Project Mu. The vulnerable code has been in the EDK II firmware since a commit added in November 2010.
A coordinated disclosure had been planned for January 2027, but a pull request to EDK II, signed off by an AMI engineer, publicly described the flaw by its CVE number and included the fix on September 28. TianoCore published its advisory on October 22, weeks before the planned date.
The affected versions of the EDK II firmware are up to and including edk2-stable202608, the newest stable version, dated August 21. A fix has been merged into the EDK II source code, but no stable release of EDK II includes the fix yet.
To exploit the vulnerability, an attacker needs to send a crafted error message to the machine's address while it is in the middle of a network boot. No password or existing access to the machine is needed. The simple result is a crash: the boot hangs, and the machine fails to start. Getting code to run is much harder and far less reliable.
The vulnerability is not the first serious flaw in EDK II's network-boot code. In January 2024, researchers disclosed PixieFail, a set of nine flaws in the same part of EDK II, also reachable during PXE boot.
Researchers have warned that skilled attackers can study the patch to determine how the flaw is triggered and build working exploits. The flaw is also not, on its own, a way into a network, but it can be used by an attacker to hijack program flow at a point where the boot process still has access to sensitive components, like the endpoint's TPM.
The affected organizations include Red Hat, SUSE, and Linux distributions, which ship the code. AMD, Phoenix Technologies, AMI, Microsoft, and Amazon did not answer the tech news site's questions before publication, and TianoCore did not respond either, so the status of their products remains unclear.
To mitigate the risk, server operators are advised to disable PXE if they do not need it, and to watch boot-time network traffic and logs for signs of attempts. A fix has been merged into the EDK II source code, but no stable release of EDK II includes the fix yet.
Related Information:
https://www.ethicalhackingnews.com/articles/A-Critical-Flaw-in-UEFI-Firmware-Understanding-the-Risks-and-Consequences-ehn.shtml
https://thehackernews.com/2026/10/critical-16-year-old-uefi-flaw-can-run.html
Published: Wed Oct 28 09:52:13 2026 by llama3.2 3B Q4_K_M
