Critical UEFI Firmware Flaw Could Expose Millions of Servers to Pre-Boot Code Execution

A critical bug in open-source EDK II firmware lets a remote attacker run code on a machine before the operating system starts. The flaw is tracked as CVE-2026-97631. It sits in the network boot (PXE) driver and received a CVSS v4 score of 9.5.

The advisory lists the NetworkPkg package in EDK II master as of September 14, 2026. EDK II is the reference code that many firmware makers use to build UEFI firmware, so the bug can reach servers, desktops, and laptops that boot over a network.

UEFI Vulnerability With No Patch

The advisory page still says “Not patched currently,” yet a fix has already been merged into the public code. Vendors must now ship that fix in their own firmware updates, which usually takes much longer.

During a PXE boot, the driver named UefiPxeBcDxe listens for ICMP error messages from the network. It copies each message into a fixed 504-byte field. The copy code checks sizes poorly in both the IPv4 and IPv6 handlers. For a message longer than 504 bytes, it keeps copying anyway. It also moves the write position forward by the total length so far instead of the length of the current piece. Attacker-controlled bytes therefore land past the end of the field. Nothing earlier on the receive path limits the message size.

The attacker needs no login and no user action. They only have to send one ICMP error message addressed to the client’s IP address while it is PXE booting. The message can come from any distance on the network. The window of exposure lasts as long as the PXE boot does.

The damage comes in two forms. The simple one is a crash. The next ICMP error triggers a CPU exception inside the DXE core, and the boot hangs. That blocks OS installs and recovery. The worse form needs more knowledge. An attacker who knows the exact firmware build can plant a fake event in the same packet. The firmware then runs the attacker’s bytes at the highest privilege level, before Secure Boot or measured boot checks anything.

Servers face the most risk because data centers often rely on PXE to install and rebuild machines in bulk. Tools that run on every reprovisioning cycle give attackers repeated chances to strike.

UEFI Security Flaws

The discovery adds to a series of firmware security failures involving network boot code, trusted signing keys, and even the images shown when a computer starts. These flaws have different entry points, but they share a concern: attackers can target code that runs before normal operating system defenses take control.

One example is PKfail, a firmware supply-chain problem caused by device makers shipping products with test Platform Keys that should never have been trusted in production. These keys help control the Secure Boot trust chain.

An attacker who obtains the matching private key can use it to replace trusted boot settings and allow malicious software to run despite Secure Boot being enabled. Cyber Security News previously covered how PKfail affected more than 200 device models, while CERT/CC’s advisory explains the risk of persistent malware on affected systems.

Another example, LogoFAIL, exposed weaknesses in the code that reads manufacturer logo images during startup. A specially crafted image could trigger code execution during the Driver Execution Environment, or DXE, phase. This is the same early firmware stage targeted by the newly disclosed PXE flaw, although the delivery method is different. As detailed in Cyber Security News’ LogoFAIL coverage, the bugs affected image-reading code used across several firmware vendors.

PixieFail provides an even closer comparison. Disclosed in January 2024, it involved nine flaws in the IPv6 network stack of TianoCore EDK II. Those weaknesses affected network boot operations used in data centers and enterprise environments.

The fix is pull request 13302. It adds proper boundary checks and corrects the pointer math. Oversized ICMP messages are now cut short once the buffer is full. The patch also clears the buffer before each copy, so stale bytes from an earlier error cannot remain. It adds unit tests that failed before the change and pass after it. Maintainers merged it on October 15, 2026.

The merge was public days before the advisory appeared on October 22. A maintainer later admitted that the embargo was broken by mistake and that the pull request was opened in the open. He asked reporters to keep using private GitHub advisories for coordinated disclosure. He also said a backlog of reports exists. The advisory credits Alex Matrosov of Anthropic and Dan Holmes-Mitra of Google for finding the bug and proposing the fix.

Ask your server and firmware vendors when they will ship an update with this fix. Until then, limit exposure by keeping PXE boot traffic on isolated provisioning networks. Block unexpected ICMP error messages aimed at booting machines, and turn off PXE on systems that do not need it. Teams should also review the CISA and NSA Secure Boot guidance for wider hardening steps.

AI is making cyberattacks faster and cheaper. Are your defenses ready to respond at machine speed?

The post Critical UEFI Firmware Flaw Could Expose Millions of Servers to Pre-Boot Code Execution appeared first on Cyber Security News.