{"id":184024,"date":"2026-10-28T23:40:36","date_gmt":"2026-10-28T21:40:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/udalyonnaya-uyazvimost-v-servernyh-uefi-proshivkah-ekspluatiruemaya-cherez-otpravku-icmp-paketa"},"modified":"2026-10-28T23:40:41","modified_gmt":"2026-10-28T21:40:41","slug":"remote-vulnerability-in-server-uefi-firmware-exploitable-by-sending-an-icmp-packet","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/remote-vulnerability-in-server-uefi-firmware-exploitable-by-sending-an-icmp-packet","title":{"rendered":"Remote vulnerability in server UEFI firmware, exploited through sending an ICMP packet","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
In TianoCore EDK II (EFI Development Kit II), the open reference implementation of UEFI used in most server motherboards, a critical vulnerability (CVE-2026-97631) has been addressed. The vulnerability exists in the PXE driver and can be exploited by sending specially crafted ICMP packets during network booting in IPv4 or IPv6 networks. The attack does not require authentication and allows an attacker to execute their code with UEFI firmware privileges before control is transferred to the operating system, which can be used to bypass the UEFI Secure Boot verification mechanism and insert malicious components during the boot process.<\/p>\n
The issue is caused by a buffer overflow in the ICMP message handler in the UefiPxeBcDxe driver, which is used for PXE booting and accepts ICMP packets during network boot to log network errors. The overflow occurs due to placing the received error messages into a fixed buffer of 504 bytes without checking the actual size of the received data. If more than 504 bytes are sent in the ICMP packet, the overflow writes outside the buffer and overlays subsequent structures. <\/p>\n