{"id":184024,"date":"2026-10-28T23:40:36","date_gmt":"2026-10-28T21:40:36","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/udalyonnaya-uyazvimost-v-servernyh-uefi-proshivkah-ekspluatiruemaya-cherez-otpravku-icmp-paketa"},"modified":"2026-10-28T23:40:41","modified_gmt":"2026-10-28T21:40:41","slug":"remote-vulnerability-in-server-uefi-firmware-exploitable-by-sending-an-icmp-packet","status":"publish","type":"post","link":"https:\/\/prohoster.info\/nl\/blog\/news\/remote-vulnerability-in-server-uefi-firmware-exploitable-by-sending-an-icmp-packet","title":{"rendered":"Afstandelijke kwetsbaarheid in server UEFI-firmware, uitgebuit via het verzenden van een ICMP-pakket","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
In TianoCore EDK II (EFI Development Kit II), an open reference implementation of UEFI used in most server motherboards, a critical vulnerability (CVE-2026-97631) has been addressed. The vulnerability exists in the PXE driver and can be exploited by sending specially crafted ICMP packets during network booting in IPv4 or IPv6 networks. The attack requires no authentication and allows an attacker to execute their code with UEFI firmware privileges before control is handed over to the operating system, which can be used to bypass the UEFI Secure Boot verification mechanism and substitute malicious components at boot time.<\/p>\n
The issue is caused by a buffer overflow in the ICMP message handler in the UefiPxeBcDxe driver, which is used for PXE booting and receives ICMP packets during network loading to capture network errors. The overflow occurs because incoming error messages are placed in a fixed 504-byte buffer without checking the actual size of the received data. If more than 504 bytes are sent in the ICMP packet, the overflowing tail is written outside the buffer and overwrites subsequent structures. <\/p>\n