# EDK II UEFI firmware: pre-boot RCE in the PXE driver via oversized ICMP errors (CVE-2026-97631) · pwn.watch > A critical buffer overflow in TianoCore EDK II, the open source UEFI code most server firmware is built on, lets an unauthenticated attacker who can send ICMP error messages to a machine while it PXE-boots corrupt memory in the PXE Base Code driver (NetworkPkg/UefiPxeBcDxe) and run code in ring 0 before Secure Boot or measured boot check anything. The bug sits in the IPv4 and IPv6 ICMP error handlers, which copy messages longer than 504 bytes past a fixed field. Reliable code execution needs knowledge of the target firmware build; otherwise the boot hangs. The fix (PR #13302) was merged to EDK II master on Oct 15 2026, but no stable EDK II tag carries it yet and the advisory lists it as not patched. Fixes reach most machines only through firmware updates from server and board vendors. Machines that boot only from disk aren't affected. Until vendor firmware ships, disable PXE/network boot where you can. TianoCore rates it critical (CVSS 4.0 9.5). Page: https://pwn.watch/i/edk2-pxe-icmp-preboot-rce-cve-2026-97631 · generated 2026-10-28T04:43:34.210Z ## Status - Severity: critical · status: live · patch: partial - Product: TianoCore EDK II (UEFI firmware, NetworkPkg/UefiPxeBcDxe) - Started: 2026-10-15 - CVEs: CVE-2026-97631 - Affected: EDK II through edk2-stable202608 (NetworkPkg/UefiPxeBcDxe); UEFI firmware built on EDK II with PXE network boot - Fixed in: EDK II master at fa78907 (PR #13302, no stable tag yet); Fedora edk2 20260812-6 (fix backported) ## Follow this incident - RSS (one item per update): https://pwn.watch/i/edk2-pxe-icmp-preboot-rce-cve-2026-97631/feed.xml - JSON Feed: https://pwn.watch/i/edk2-pxe-icmp-preboot-rce-cve-2026-97631/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/edk2-pxe-icmp-preboot-rce-cve-2026-97631.json - This file: https://pwn.watch/i/edk2-pxe-icmp-preboot-rce-cve-2026-97631/llms.txt ## Updates (newest first) - 2026-10-27: Ars Technica reports the bug affects firmware from most server vendors. The finders had planned a coordinated disclosure in January, but the public fix broke the embargo. Intel says none of its supported commercial products are known to be affected; Arm says it isn't directly applicable to its portfolio. (https://arstechnica.com/security/2026/10/code-execution-flaw-in-uefi-firmware-threatens-most-servers-on-planet-earth/) - 2026-10-26: Fedora backports the fix into edk2 20260812-6 (updates-testing). Debian still lists its edk2 packages as vulnerable. (https://packages.fedoraproject.org/pkgs/edk2/edk2-aarch64/fedora-43-updates-testing.html) - 2026-10-22: TianoCore publishes GHSA-99cj-7hg9-mp4m (critical, CVSS 4.0 9.5): pre-boot RCE in the EDK II PXE driver, patched versions listed as "Not patched currently". Credited to Alex Matrosov (Anthropic) and Dan Holmes-Mitra (Google). (https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m) - 2026-10-15: PR #13302, "NetworkPkg/UefiPxeBcDxe: Fix ICMP buffer overflow in IPv4/IPv6 handle (CVE-2026-97631)", is merged into EDK II master as fa78907. The latest stable tag, edk2-stable202608 from Aug 21, doesn't include it. (https://github.com/tianocore/edk2/pull/13302) ## Fix brief # Security brief: EDK II UEFI firmware: pre-boot RCE in the PXE driver via oversized ICMP errors (CVE-2026-97631) Source: https://pwn.watch/i/edk2-pxe-icmp-preboot-rce-cve-2026-97631 · status: live · severity: critical · updated Oct 28, 2026, 04:42 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is A critical buffer overflow in TianoCore EDK II, the open source UEFI code most server firmware is built on, lets an unauthenticated attacker who can send ICMP error messages to a machine while it PXE-boots corrupt memory in the PXE Base Code driver (NetworkPkg/UefiPxeBcDxe) and run code in ring 0 before Secure Boot or measured boot check anything. The bug sits in the IPv4 and IPv6 ICMP error handlers, which copy messages longer than 504 bytes past a fixed field. Reliable code execution needs knowledge of the target firmware build; otherwise the boot hangs. The fix (PR #13302) was merged to EDK II master on Oct 15 2026, but no stable EDK II tag carries it yet and the advisory lists it as not patched. Fixes reach most machines only through firmware updates from server and board vendors. Machines that boot only from disk aren't affected. Until vendor firmware ships, disable PXE/network boot where you can. TianoCore rates it critical (CVSS 4.0 9.5). Severity detail: CVSS 4.0 9.5 per the TianoCore advisory; exploitation needs network reach to the machine during PXE boot, and code execution needs a payload tuned to the target firmware build - Product: TianoCore EDK II (UEFI firmware, NetworkPkg/UefiPxeBcDxe) - CVE / advisory ids: CVE-2026-97631 ## Affected versions - EDK II through edk2-stable202608 (NetworkPkg/UefiPxeBcDxe) - UEFI firmware built on EDK II with PXE network boot ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - EDK II master at fa78907 (PR #13302, no stable tag yet) - Fedora edk2 20260812-6 (fix backported) After upgrading, re-run the checks above and redeploy/restart the affected services. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Specific notes This is a firmware bug: there's nothing to bump in an app's dependencies. For servers and VMs, check whether their UEFI firmware is built on EDK II with PXE network boot, and ask the server, board or cloud vendor for a firmware (BIOS/UEFI) update that includes EDK II commit fa78907. For QEMU/KVM guests using OVMF/AAVMF, update the distro's edk2 package once a fixed build ships (Fedora has 20260812-6 in updates-testing). Until then, turn off PXE/network boot on machines that boot from disk, and keep PXE provisioning on isolated, trusted network segments. ## Latest updates - Oct 27, 2026: Ars Technica reports the bug affects firmware from most server vendors. The finders had planned a coordinated disclosure in January, but the public fix broke the embargo. Intel says none of its supported commercial products are known to be affected; Arm says it isn't directly applicable to its portfolio. - Oct 26, 2026: Fedora backports the fix into edk2 20260812-6 (updates-testing). Debian still lists its edk2 packages as vulnerable. - Oct 22, 2026: TianoCore publishes GHSA-99cj-7hg9-mp4m (critical, CVSS 4.0 9.5): pre-boot RCE in the EDK II PXE driver, patched versions listed as "Not patched currently". Credited to Alex Matrosov (Anthropic) and Dan Holmes-Mitra (Google). - Oct 15, 2026: PR #13302, "NetworkPkg/UefiPxeBcDxe: Fix ICMP buffer overflow in IPv4/IPv6 handle (CVE-2026-97631)", is merged into EDK II master as fa78907. The latest stable tag, edk2-stable202608 from Aug 21, doesn't include it. ## Advisories - [GHSA-99cj-7hg9-mp4m: Pre-boot RCE in EDK II PXE driver (CVE-2026-97631)](https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m) (TianoCore EDK II) - [NVD: CVE-2026-97631](https://nvd.nist.gov/vuln/detail/CVE-2026-97631) (NVD) - [NetworkPkg/UefiPxeBcDxe: Fix ICMP buffer overflow in IPv4/IPv6 handle (CVE-2026-97631), PR #13302](https://github.com/tianocore/edk2/pull/13302) (TianoCore EDK II) - [Debian security tracker: CVE-2026-97631](https://security-tracker.debian.org/tracker/CVE-2026-97631) (Debian) ## Write-ups & news - [Code-execution flaw in UEFI firmware affects most servers on planet Earth](https://arstechnica.com/security/2026/10/code-execution-flaw-in-uefi-firmware-threatens-most-servers-on-planet-earth/) --- Machine-readable: https://pwn.watch/i/edk2-pxe-icmp-preboot-rce-cve-2026-97631.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.