A critical 9.5/10 vulnerability in EDK2 UEFI firmware, tracked as CVE-2026-97631, allows attackers to execute code before the OS boots. Found in the PXE-Base Code driver’s ICMP parser, the 16-year-old buffer overflow enables remote code execution via network boot. Discovered by Alex Matrosov (Anthropic) and Dan Holmes (Google), the flaw bypasses Secure Boot and TPM protections.
While payloads lack persistence, they can install boot-time malware. AMI, Insyde, Phoenix, and Microsoft’s Project Mu all use the affected code. Patching is difficult across millions of devices.
Security expert HD Moore warns the bug could break disk encryption if attackers gain brief network access. Coordinated disclosure was planned for January, but AMI published a fix early. With public patches available, exploitation is imminent.
Source: Ars Technica · Summarized by HeadlinesBriefing