Overview
- TianoCore confirmed a critical buffer-overflow in its EDK II PXE-Base Code, tracked as CVE-2026-97631, that can corrupt DXE-phase memory and let attacker code run before the operating system loads.
- The bug stems from a 2010 coding error that fails to enforce a 504-byte limit when handling ICMP error messages during PXE network boot, allowing an oversized message to overwrite nearby firmware memory.
- AMI published a fix before the coordinated disclosure and TianoCore issued an advisory on October 22, which made the technical details public and increased the risk that researchers or attackers can develop exploits.
- Only systems that use EDK II-based firmware with PXE enabled are at risk, and exploitation requires delivering a crafted ICMP message while the device is actively network-booting, so most disk-only home users are not affected.
- Organisations should contact firmware vendors, disable network boot where possible, monitor boot-time network logs, and plan staged firmware updates because OEM patch rollouts can take weeks to months and Secure Boot or TPM do not stop this pre‑OS attack.