EDK II UEFI firmware: pre-boot RCE in the PXE driver via oversized ICMP errors (CVE-2026-97631) ยท updates https://pwn.watch/i/edk2-pxe-icmp-preboot-rce-cve-2026-97631 A critical buffer overflow in TianoCore EDK II, the open source UEFI code most server firmware is built on, lets an unauthenticated attacker who can send ICMP error messages to a machine while it PXE-boots corrupt memory in the PXE Base Code driver (NetworkPkg/UefiPxeBcDxe) and run code in ring 0 before Secure Boot or measured boot check anything. The bug sits in the IPv4 and IPv6 ICMP error handlers, which copy messages longer than 504 bytes past a fixed field. Reliable code execution needs knowledge of the target firmware build; otherwise the boot hangs. The fix (PR #13302) was merged to EDK II master on Oct 15 2026, but no stable EDK II tag carries it yet and the advisory lists it as not patched. Fixes reach most machines only through firmware updates from server and board vendors. Machines that boot only from disk aren't affected. Until vendor firmware ships, disable PXE/network boot where you can. TianoCore rates it critical (CVSS 4.0 9.5). en Tue, 27 Oct 2026 00:00:00 GMT EDK II UEFI firmware: pre-boot RCE in the PXE driver via oversized ICMP errors (CVE-2026-97631): Ars Technica reports the bug affects firmware from most server vendors. The finders had planned a coordinated disclosure in January, but the public fix broke the embargo. Intel says none of its supported commercial products are known to be affected; Arm says it isn't directly applicable to its portfolio. https://pwn.watch/i/edk2-pxe-icmp-preboot-rce-cve-2026-97631 https://pwn.watch/i/edk2-pxe-icmp-preboot-rce-cve-2026-97631#2026-10-27-3a0e41f0 Tue, 27 Oct 2026 00:00:00 GMT critical <p><a href="https://arstechnica.com/security/2026/10/code-execution-flaw-in-uefi-firmware-threatens-most-servers-on-planet-earth/">Source</a></p> EDK II UEFI firmware: pre-boot RCE in the PXE driver via oversized ICMP errors (CVE-2026-97631): Fedora backports the fix into edk2 20260812-6 (updates-testing). Debian still lists its edk2 packages as vulnerable. https://pwn.watch/i/edk2-pxe-icmp-preboot-rce-cve-2026-97631 https://pwn.watch/i/edk2-pxe-icmp-preboot-rce-cve-2026-97631#2026-10-26-47d4a2f5 Mon, 26 Oct 2026 00:00:00 GMT critical <p><a href="https://packages.fedoraproject.org/pkgs/edk2/edk2-aarch64/fedora-43-updates-testing.html">Source</a></p> EDK II UEFI firmware: pre-boot RCE in the PXE driver via oversized ICMP errors (CVE-2026-97631): TianoCore publishes GHSA-99cj-7hg9-mp4m (critical, CVSS 4.0 9.5): pre-boot RCE in the EDK II PXE driver, patched versions listed as "Not patched currently". Credited to Alex Matrosov (Anthropic) and Dan Holmes-Mitra (Google). https://pwn.watch/i/edk2-pxe-icmp-preboot-rce-cve-2026-97631 https://pwn.watch/i/edk2-pxe-icmp-preboot-rce-cve-2026-97631#2026-10-22-aac4fb7d Thu, 22 Oct 2026 00:00:00 GMT critical <p><a href="https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m">Source</a></p> EDK II UEFI firmware: pre-boot RCE in the PXE driver via oversized ICMP errors (CVE-2026-97631): PR #13302, "NetworkPkg/UefiPxeBcDxe: Fix ICMP buffer overflow in IPv4/IPv6 handle (CVE-2026-97631)", is merged into EDK II master as fa78907. The latest stable tag, edk2-stable202608 from Aug 21, doesn't include it. https://pwn.watch/i/edk2-pxe-icmp-preboot-rce-cve-2026-97631 https://pwn.watch/i/edk2-pxe-icmp-preboot-rce-cve-2026-97631#2026-10-15-8a143d1e Thu, 15 Oct 2026 00:00:00 GMT critical <p><a href="https://github.com/tianocore/edk2/pull/13302">Source</a></p>