{"id":184024,"date":"2026-10-28T23:40:36","date_gmt":"2026-10-28T21:40:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/udalyonnaya-uyazvimost-v-servernyh-uefi-proshivkah-ekspluatiruemaya-cherez-otpravku-icmp-paketa"},"modified":"2026-10-28T23:40:41","modified_gmt":"2026-10-28T21:40:41","slug":"remote-vulnerability-in-server-uefi-firmware-exploitable-by-sending-an-icmp-packet","status":"publish","type":"post","link":"https:\/\/prohoster.info\/de\/blog\/news\/remote-vulnerability-in-server-uefi-firmware-exploitable-by-sending-an-icmp-packet","title":{"rendered":"Entfernte Sicherheitsanf\u00e4lligkeit in Server-UEFI-Firmware, ausgenutzt durch das Senden von ICMP-Paketen","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
In TianoCore EDK II (EFI Development Kit II), an open reference implementation of UEFI used in most server motherboards, a critical vulnerability (CVE-2026-97631) has been discovered. The vulnerability exists in the PXE driver and can be exploited by sending specially crafted ICMP packets during network booting in IPv4 or IPv6 networks. The attack does not require authentication and allows an attacker to execute their code with UEFI firmware privileges at a stage before control is passed to the operating system, which can be used to bypass the UEFI Secure Boot verification mechanism and substitute malicious components during the boot process.<\/p>\n
The problem is caused by a buffer overflow in the ICMP message handler in the UefiPxeBcDxe driver, which is used for PXE booting and accepts ICMP packets during network booting to log network errors. The overflow occurs because incoming error messages are placed into a fixed buffer of 504 bytes without checking the actual size of the received data. If more than 504 bytes are sent in the ICMP packet, the overflowing tail is written beyond the buffer and overlaps with subsequent structures. <\/p>\n