CVE-2026-97631
EPSS 0.6%Working patches deployed, premature disclosure, credible defender triage underway; not yet confirmed in-the-wild exploitation.
What: Out-of-bounds write in TianoCore EDK2 UEFI firmware PXE driver enabling pre-boot arbitrary code execution on network-booting servers; affects BIOS/firmware layer across most enterprise infrastructure.
Why it matters: Premature public disclosure (6 days post-NVD) combined with vendor patches already shipped (AMI, others) signals active mitigation but wide exposure window. Pre-boot RCE allows bootkit-level persistence before OS loads. EPSS 0.37% is low, but attack surface (network boot in data centers) and impact (firmware compromise) are severe. Not yet KEV-listed, but chatter reflects urgency.
Where it's seen: Ars Technica coverage, multi-vendor firmware advisories, Bluesky security community debating patch status and PXE-boot prevalence. Posts emphasize scope (most servers), persistence risk, and need for firmware updates. Discussions center on disclosure timing, not PoC availability.
RISK: CRITICAL — Pre-boot RCE in UEFI affects enterprise server firmware; bootkit persistence, wide install base.
Description
EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality, Integrity, and Availability.