A serious flaw has been discovered in the open-source EDK II firmware that allows remote attackers to execute code on machines before the operating system boots. This vulnerability, identified as CVE-2026-97631, affects the network boot (PXE) driver and has received a high CVSS v4 score of 9.5, indicating its severity. The flaw stems from inadequate size checks in the UefiPxeBcDxe driver, which processes ICMP error messages during PXE booting. Attackers can exploit this by sending an oversized ICMP error message to a client’s IP address, potentially causing a system crash or enabling the execution of malicious code at a high privilege level.
The vulnerability significantly impacts servers in data centers, which frequently use PXE booting for machine provisioning and recovery. The advisory initially noted that the flaw was unpatched, but a fix has since been merged into the public code. Firmware vendors now face the task of integrating this fix into their updates, a process that can be time-consuming. The patch addresses the flaw by implementing proper boundary checks and correcting pointer arithmetic, ensuring that oversized messages are truncated and buffers are cleared before copying data.
This discovery is part of an ongoing series of firmware security issues, highlighting how attackers can target pre-operating system code. Previous cases like PKfail and LogoFAIL similarly exposed vulnerabilities in firmware, affecting Secure Boot processes and image reading during startup, respectively. The current vulnerability underscores the importance of maintaining secure firmware practices, especially in environments where network booting is prevalent.
Organizations should proactively work with their vendors to obtain firmware updates that include the fix for CVE-2026-97631. In the interim, it is advisable to isolate PXE boot traffic on dedicated networks and block unexpected ICMP error messages to minimize risk. Disabling PXE on systems where it is not required can further reduce exposure. Additionally, teams are encouraged to consult CISA and NSA guidelines for strengthening Secure Boot processes.
