In TianoCore EDK II (EFI Development Kit II), the open reference implementation of UEFI used in most server motherboards, a critical vulnerability (CVE-2026-97631) has been addressed. The vulnerability exists in the PXE driver and can be exploited by sending specially crafted ICMP packets during network booting in IPv4 or IPv6 networks. The attack does not require authentication and allows an attacker to execute their code with UEFI firmware privileges before control is transferred to the operating system, which can be used to bypass the UEFI Secure Boot verification mechanism and insert malicious components during the boot process.
The issue is caused by a buffer overflow in the ICMP message handler in the UefiPxeBcDxe driver, which is used for PXE booting and accepts ICMP packets during network boot to log network errors. The overflow occurs due to placing the received error messages into a fixed buffer of 504 bytes without checking the actual size of the received data. If more than 504 bytes are sent in the ICMP packet, the overflow writes outside the buffer and overlays subsequent structures.
The attack can be conducted from the public internet — it is sufficient to know the victim's IP address and be able to determine the moment of PXE boot. Knowing the exact firmware used on the server victim, the attacker can prepare an exploit considering the memory layout of the specific firmware build and exploit the vulnerability to execute code at the DXE (Driver Execution Environment) level, which runs in ring zero protection.
The EDK II project was opened in 2004 by Intel and is used by all major firmware manufacturers for server systems, data centers, and cloud providers. Among other things, it is utilized in AMI, Insyde, and Phoenix firmware. The vulnerability is also present in firmware based on Microsoft's Mu platform, which is a fork of EDK II.
The problem was identified by representatives from Anthropic and Google, and a coordinated public disclosure was scheduled for January 2027. However, the information had to be revealed earlier, as an engineer from AMI accidentally breached the embargo and published a public pull request with a fix, based on which the essence of the vulnerability could be understood.
Source: opennet.ru
