CVE-2026-97631: 16‑Year‑Old UEFI Buffer Overflow Lets Attackers Execute Code Pre‑OS
What It Is — A critical firmware flaw (CVE‑2026‑97631) in the open‑source TianoCore EDK II code base scores 9.5 CVSS. The vulnerability resides in the PXE‑Base Code driver’s handling of ICMP error packets: the driver copies incoming data into a fixed 504‑byte buffer without length checks, enabling an out‑of‑bounds write. An unauthenticated network attacker who can inject crafted ICMP messages during PXE boot can corrupt DXE‑phase memory and achieve arbitrary code execution before the operating system, Secure Boot, or measured boot are active. The bug affects any server, storage appliance, or network device that uses EDK II‑based UEFI firmware—including implementations from AMI, Insyde, Phoenix, and Microsoft’s Project Mu. No public exploits have been observed, but the attack surface is broad and the impact could span confidentiality, integrity, and availability.
Affected Products — All platforms built on TianoCore EDK II firmware (e.g., servers, hyper‑visors, storage gear) from vendors such as AMI, Insyde, Phoenix, and Microsoft Project Mu.
Why It Matters for Trust & Control Assurance — The flaw highlights the need for a control that guarantees firmware integrity and enforces secure‑boot verification, a single objective that satisfies multiple framework requirements (e.g., NIST CSF 2.0, ISO 27001).
Recommended Actions —
- Verify firmware version and apply the vendor‑supplied patch for the EDK II component immediately.
- Enable and enforce Secure Boot/Measured Boot on all servers; validate the boot chain with TPM attestation.
- Incorporate firmware‑integrity checks into your continuous compliance evidence collection.
- Document the remediation in your control‑mapping repository to demonstrate readiness for audits.
Source: Security Affairs