A severe vulnerability has been uncovered in the TianoCore EDK II, the open source codebase widely used by server vendors and data centers to implement UEFI firmware. Rated at 9.5 out of 10 in severity, this flaw allows attackers to execute malicious code early in the boot process, bypassing critical security measures such as Secure Boot and the Trusted Platform Module. The vulnerability, identified as CVE-2026-97631, is a memory-corruption issue within an ICMP component that can be exploited to run malware before the operating system's defenses are in place.

This vulnerability is particularly concerning because it affects almost all UEFI suppliers, including major independent BIOS vendors like AMI, Insyde, and Phoenix. The discovery was made by Alex Matrosov of Anthropic and Dan Holmes of Google. They planned a coordinated disclosure for January, but the issue became public following a premature code fix release by AMI. This has heightened the risk of exploitation, as advanced hackers now have access to the patch code, making it easier to develop working exploits.

The flaw stems from a 16-year-old buffer overflow in the PXE Base Code driver, which facilitates network booting for servers and other devices. During this process, a network listener monitors for ICMP errors, but due to improper bounds handling, a message longer than 504 bytes can overwrite adjacent memory. This enables attackers with network access to deliver malicious payloads that execute at the CPU's highest privilege level, creating significant security risks.

Although the vulnerability does not provide an initial entry point into networks, it requires attackers to have some level of control over the local network. This limits exploitation to insiders or those who have already breached network defenses. Furthermore, exploiting the flaw requires specific knowledge of target system addresses, making it a targeted rather than widespread threat.

Organizations using machines that boot from local networks need to prioritize deploying BIOS or UEFI updates to mitigate this risk. Unlike some previous high-profile vulnerabilities, this issue can be addressed with a straightforward code fix, without the complexities of key management updates.