{
  "slug": "edk2-pxe-icmp-preboot-rce-cve-2026-97631",
  "category": "patch",
  "title": "EDK II UEFI firmware: pre-boot RCE in the PXE driver via oversized ICMP errors (CVE-2026-97631)",
  "summary": "A critical buffer overflow in TianoCore EDK II, the open source UEFI code most server firmware is built on, lets an unauthenticated attacker who can send ICMP error messages to a machine while it PXE-boots corrupt memory in the PXE Base Code driver (NetworkPkg/UefiPxeBcDxe) and run code in ring 0 before Secure Boot or measured boot check anything. The bug sits in the IPv4 and IPv6 ICMP error handlers, which copy messages longer than 504 bytes past a fixed field. Reliable code execution needs knowledge of the target firmware build; otherwise the boot hangs. The fix (PR #13302) was merged to EDK II master on Oct 15 2026, but no stable EDK II tag carries it yet and the advisory lists it as not patched. Fixes reach most machines only through firmware updates from server and board vendors. Machines that boot only from disk aren't affected. Until vendor firmware ships, disable PXE/network boot where you can. TianoCore rates it critical (CVSS 4.0 9.5).",
  "cveIds": [
    "CVE-2026-97631"
  ],
  "product": "TianoCore EDK II (UEFI firmware, NetworkPkg/UefiPxeBcDxe)",
  "stacks": [],
  "tags": [
    "tianocore",
    "edk2",
    "uefi",
    "firmware",
    "pxe",
    "secure-boot",
    "rce",
    "hetzner"
  ],
  "severity": "critical",
  "severityNote": "CVSS 4.0 9.5 per the TianoCore advisory; exploitation needs network reach to the machine during PXE boot, and code execution needs a payload tuned to the target firmware build",
  "status": "live",
  "startedAt": "2026-10-15",
  "patchStatus": "partial",
  "affectedVersions": [
    "EDK II through edk2-stable202608 (NetworkPkg/UefiPxeBcDxe)",
    "UEFI firmware built on EDK II with PXE network boot"
  ],
  "fixedVersions": [
    "EDK II master at fa78907 (PR #13302, no stable tag yet)",
    "Fedora edk2 20260812-6 (fix backported)"
  ],
  "timeline": [
    {
      "date": "2026-10-15",
      "title": "PR #13302, \"NetworkPkg/UefiPxeBcDxe: Fix ICMP buffer overflow in IPv4/IPv6 handle (CVE-2026-97631)\", is merged into EDK II master as fa78907. The latest stable tag, edk2-stable202608 from Aug 21, doesn't include it.",
      "sourceUrl": "https://github.com/tianocore/edk2/pull/13302"
    },
    {
      "date": "2026-10-22",
      "title": "TianoCore publishes GHSA-99cj-7hg9-mp4m (critical, CVSS 4.0 9.5): pre-boot RCE in the EDK II PXE driver, patched versions listed as \"Not patched currently\". Credited to Alex Matrosov (Anthropic) and Dan Holmes-Mitra (Google).",
      "sourceUrl": "https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m"
    },
    {
      "date": "2026-10-26",
      "title": "Fedora backports the fix into edk2 20260812-6 (updates-testing). Debian still lists its edk2 packages as vulnerable.",
      "sourceUrl": "https://packages.fedoraproject.org/pkgs/edk2/edk2-aarch64/fedora-43-updates-testing.html"
    },
    {
      "date": "2026-10-27",
      "title": "Ars Technica reports the bug affects firmware from most server vendors. The finders had planned a coordinated disclosure in January, but the public fix broke the embargo. Intel says none of its supported commercial products are known to be affected; Arm says it isn't directly applicable to its portfolio.",
      "sourceUrl": "https://arstechnica.com/security/2026/10/code-execution-flaw-in-uefi-firmware-threatens-most-servers-on-planet-earth/"
    },
    {
      "date": "2026-10-28",
      "title": "Hetzner posts a status notice on CVE-2026-97631: an official patch isn't available yet, running systems aren't directly at risk, and it recommends avoiding reboots of hosts that use PXE boot until further notice while it analyzes its environment.",
      "sourceUrl": "https://status.hetzner.com/incident/54493dac-b3a2-44f0-8d8b-6de8b25d8f17"
    }
  ],
  "grouping": "none",
  "sources": [
    {
      "kind": "advisory",
      "title": "GHSA-99cj-7hg9-mp4m: Pre-boot RCE in EDK II PXE driver (CVE-2026-97631)",
      "url": "https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m",
      "publisher": "TianoCore EDK II",
      "date": "2026-10-22"
    },
    {
      "kind": "advisory",
      "title": "NVD: CVE-2026-97631",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97631",
      "publisher": "NVD",
      "date": "2026-10-22"
    },
    {
      "kind": "advisory",
      "title": "NetworkPkg/UefiPxeBcDxe: Fix ICMP buffer overflow in IPv4/IPv6 handle (CVE-2026-97631), PR #13302",
      "url": "https://github.com/tianocore/edk2/pull/13302",
      "publisher": "TianoCore EDK II",
      "date": "2026-10-15"
    },
    {
      "kind": "advisory",
      "title": "Debian security tracker: CVE-2026-97631",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-97631",
      "publisher": "Debian",
      "date": "2026-10-28"
    },
    {
      "kind": "advisory",
      "title": "Red Hat CVE-2026-97631: edk2 pre-boot RCE in EDK II PXE driver (Bugzilla 2559129), Red Hat CVSS 8.8",
      "url": "https://access.redhat.com/security/cve/CVE-2026-97631",
      "publisher": "Red Hat",
      "date": "2026-10-28"
    },
    {
      "kind": "advisory",
      "title": "Hetzner status: CVE-2026-97631 - critical security vulnerability in the EDK II UEFI firmware component",
      "url": "https://status.hetzner.com/incident/54493dac-b3a2-44f0-8d8b-6de8b25d8f17",
      "publisher": "Hetzner",
      "date": "2026-10-28"
    },
    {
      "kind": "news",
      "title": "Code-execution flaw in UEFI firmware affects most servers on planet Earth",
      "url": "https://arstechnica.com/security/2026/10/code-execution-flaw-in-uefi-firmware-threatens-most-servers-on-planet-earth/",
      "publisher": "Ars Technica",
      "date": "2026-10-27"
    }
  ],
  "tweets": [],
  "agentNotes": "This is a firmware bug: there's nothing to bump in an app's dependencies. For servers and VMs, check whether their UEFI firmware is built on EDK II with PXE network boot, and ask the server, board or cloud vendor for a firmware (BIOS/UEFI) update that includes EDK II commit fa78907. For QEMU/KVM guests using OVMF/AAVMF, update the distro's edk2 package once a fixed build ships (Fedora has 20260812-6 in updates-testing). Until then, turn off PXE/network boot on machines that boot from disk, and keep PXE provisioning on isolated, trusted network segments.",
  "updatedAt": "2026-10-30T14:46:51Z",
  "xPost": {
    "id": "2115270075523715363",
    "postedAt": "2026-10-28T02:31:00.804Z",
    "url": "https://x.com/pwnwatch_app/status/2115270075523715363"
  },
  "url": "https://pwn.watch/i/edk2-pxe-icmp-preboot-rce-cve-2026-97631",
  "json": "https://pwn.watch/i/edk2-pxe-icmp-preboot-rce-cve-2026-97631.json",
  "sections": [],
  "agentBrief": "# Security brief: EDK II UEFI firmware: pre-boot RCE in the PXE driver via oversized ICMP errors (CVE-2026-97631)\n\nSource: https://pwn.watch/i/edk2-pxe-icmp-preboot-rce-cve-2026-97631 · status: live · severity: critical · updated Oct 30, 2026, 14:46 UTC\n\n## Patch status\n**PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.**\n\n## What it is\nA critical buffer overflow in TianoCore EDK II, the open source UEFI code most server firmware is built on, lets an unauthenticated attacker who can send ICMP error messages to a machine while it PXE-boots corrupt memory in the PXE Base Code driver (NetworkPkg/UefiPxeBcDxe) and run code in ring 0 before Secure Boot or measured boot check anything. The bug sits in the IPv4 and IPv6 ICMP error handlers, which copy messages longer than 504 bytes past a fixed field. Reliable code execution needs knowledge of the target firmware build; otherwise the boot hangs. The fix (PR #13302) was merged to EDK II master on Oct 15 2026, but no stable EDK II tag carries it yet and the advisory lists it as not patched. Fixes reach most machines only through firmware updates from server and board vendors. Machines that boot only from disk aren't affected. Until vendor firmware ships, disable PXE/network boot where you can. TianoCore rates it critical (CVSS 4.0 9.5).\n\nSeverity detail: CVSS 4.0 9.5 per the TianoCore advisory; exploitation needs network reach to the machine during PXE boot, and code execution needs a payload tuned to the target firmware build\n\n- Product: TianoCore EDK II (UEFI firmware, NetworkPkg/UefiPxeBcDxe)\n- CVE / advisory ids: CVE-2026-97631\n\n## Affected versions\n- EDK II through edk2-stable202608 (NetworkPkg/UefiPxeBcDxe)\n- UEFI firmware built on EDK II with PXE network boot\n\n## Check whether you're affected\nNo generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.\n\n## Fix\nUpgrade to one of these fixed versions (or later on the same branch):\n- EDK II master at fa78907 (PR #13302, no stable tag yet)\n- Fedora edk2 20260812-6 (fix backported)\n\nAfter upgrading, re-run the checks above and redeploy/restart the affected services.\n\n## Mitigations\nThe data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows).\n\n## Specific notes\nThis is a firmware bug: there's nothing to bump in an app's dependencies. For servers and VMs, check whether their UEFI firmware is built on EDK II with PXE network boot, and ask the server, board or cloud vendor for a firmware (BIOS/UEFI) update that includes EDK II commit fa78907. For QEMU/KVM guests using OVMF/AAVMF, update the distro's edk2 package once a fixed build ships (Fedora has 20260812-6 in updates-testing). Until then, turn off PXE/network boot on machines that boot from disk, and keep PXE provisioning on isolated, trusted network segments.\n\n## Latest updates\n- Oct 28, 2026: Hetzner posts a status notice on CVE-2026-97631: an official patch isn't available yet, running systems aren't directly at risk, and it recommends avoiding reboots of hosts that use PXE boot until further notice while it analyzes its environment.\n- Oct 27, 2026: Ars Technica reports the bug affects firmware from most server vendors. The finders had planned a coordinated disclosure in January, but the public fix broke the embargo. Intel says none of its supported commercial products are known to be affected; Arm says it isn't directly applicable to its portfolio.\n- Oct 26, 2026: Fedora backports the fix into edk2 20260812-6 (updates-testing). Debian still lists its edk2 packages as vulnerable.\n- Oct 22, 2026: TianoCore publishes GHSA-99cj-7hg9-mp4m (critical, CVSS 4.0 9.5): pre-boot RCE in the EDK II PXE driver, patched versions listed as \"Not patched currently\". Credited to Alex Matrosov (Anthropic) and Dan Holmes-Mitra (Google).\n- Oct 15, 2026: PR #13302, \"NetworkPkg/UefiPxeBcDxe: Fix ICMP buffer overflow in IPv4/IPv6 handle (CVE-2026-97631)\", is merged into EDK II master as fa78907. The latest stable tag, edk2-stable202608 from Aug 21, doesn't include it.\n\n## Advisories\n- [GHSA-99cj-7hg9-mp4m: Pre-boot RCE in EDK II PXE driver (CVE-2026-97631)](https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m) (TianoCore EDK II)\n- [NVD: CVE-2026-97631](https://nvd.nist.gov/vuln/detail/CVE-2026-97631) (NVD)\n- [NetworkPkg/UefiPxeBcDxe: Fix ICMP buffer overflow in IPv4/IPv6 handle (CVE-2026-97631), PR #13302](https://github.com/tianocore/edk2/pull/13302) (TianoCore EDK II)\n- [Debian security tracker: CVE-2026-97631](https://security-tracker.debian.org/tracker/CVE-2026-97631) (Debian)\n- [Red Hat CVE-2026-97631: edk2 pre-boot RCE in EDK II PXE driver (Bugzilla 2559129), Red Hat CVSS 8.8](https://access.redhat.com/security/cve/CVE-2026-97631) (Red Hat)\n- [Hetzner status: CVE-2026-97631 - critical security vulnerability in the EDK II UEFI firmware component](https://status.hetzner.com/incident/54493dac-b3a2-44f0-8d8b-6de8b25d8f17) (Hetzner)\n\n## Write-ups & news\n- [Code-execution flaw in UEFI firmware affects most servers on planet Earth](https://arstechnica.com/security/2026/10/code-execution-flaw-in-uefi-firmware-threatens-most-servers-on-planet-earth/)\n\n---\nMachine-readable: https://pwn.watch/i/edk2-pxe-icmp-preboot-rce-cve-2026-97631.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems."
}