EDK II UEFI firmware: pre-boot RCE in the PXE driver via oversized ICMP errors (CVE-2026-97631)

A critical buffer overflow in TianoCore EDK II, the open source UEFI code most server firmware is built on, lets an unauthenticated attacker who can send ICMP error messages to a machine while it PXE-boots corrupt memory in the PXE Base Code driver (NetworkPkg/UefiPxeBcDxe) and run code in ring 0 before Secure Boot or measured boot check anything. The bug sits in the IPv4 and IPv6 ICMP error handlers, which copy messages longer than 504 bytes past a fixed field. Reliable code execution needs knowledge of the target firmware build; otherwise the boot hangs. The fix (PR #13302) was merged to EDK II master on Oct 15 2026, but no stable EDK II tag carries it yet and the advisory lists it as not patched. Fixes reach most machines only through firmware updates from server and board vendors. Machines that boot only from disk aren't affected. Until vendor firmware ships, disable PXE/network boot where you can. TianoCore rates it critical (CVSS 4.0 9.5).

Why this severity: CVSS 4.0 9.5 per the TianoCore advisory; exploitation needs network reach to the machine during PXE boot, and code execution needs a payload tuned to the target firmware build

Started

Oct 15, 2026

CVE

CVE-2026-97631

• #TianoCore
• #EDK II
• #Uefi
• #Firmware
• #PXE
• #Secure Boot
• RCE