Critical Firmware Vulnerability Found in EDK II Code
The network boot flaw allows remote code execution at the highest privilege level, requiring urgent vendor firmware updates.
Updated on Oct. 28, 2026 in Cybersecurity
Live Poll
Do you trust that tech companies adequately protect your devices against newly discovered security flaws?
Researchers have identified a critical remote code execution vulnerability, tracked as CVE-2026-97631, in the open-source EDK II software. The flaw, which allows unauthorized code execution before an operating system boots, has been patched in the project's public code.
Why it matters
The vulnerability enables attackers to bypass operating system security by compromising devices at the highest privilege level during the network boot phase. Patching requires hardware vendors to integrate the updated firmware into their own software releases for servers, desktops, and laptops.
The vulnerability carries a critical CVSS v4 score of 9.5. It stems from a buffer overflow in the network boot driver, which improperly handles incoming ICMP error messages within a fixed 504-byte field.
The players
Alex Matrosov
Security researcher who discovered the vulnerability.
Dan Holmes-Mitra
Security researcher who discovered the vulnerability.
The details
The flaw resides within the NetworkPkg package of the EDK II master code, specifically in the UefiPxeBcDxe driver. This driver manages Preboot Execution Environment (PXE) requests, but it fails to perform adequate size checks when copying ICMP error messages. By sending a malformed message to a client IP address during the network boot process, an attacker can overwrite memory and execute arbitrary code with the highest level of system privilege.
Timeline
September 14, 2026: The EDK II master package was identified in the security advisory.
October 15, 2026: Project maintainers merged the patch into the public code.
October 22, 2026: The formal security advisory was published.
The Tech Race
This vulnerability underscores the persistent challenge of securing low-level boot firmware, a critical component that predates the operating system. It follows a pattern of recent discovery efforts targeting the EDK II code base to eliminate high-privilege attack vectors before they can be exploited.
Users of servers, desktops, and laptops that rely on network booting are currently exposed to this remote code execution risk. Mitigation depends on hardware vendors applying the provided patch to their firmware, meaning users should monitor manufacturer support sites for forthcoming updates.
The takeaway
The security of network-booted devices now hinges on how quickly vendors push the October 15, 2026, code fix to their hardware. Users should track vendor-specific firmware release notes to identify when this specific patch has been integrated into their system's BIOS or UEFI.
Further reading
For broader trends in firmware integrity, explore the latest research in our Cybersecurity section.
Live Poll
Do you trust that tech companies adequately protect your devices against newly discovered security flaws?
