A critical vulnerability, CVE-2026-97631, in the PXE Base Code driver of the TianoCore EDK II UEFI firmware enables remote code execution at boot, potentially compromising the chain of trust before Secure Boot and TPM defenses take effect.

The flaw is a long-standing buffer overflow in the PXE-Base Code driver that processes ICMP error messages during network boot, allowing a local-network attacker to run code with highest privileges (ring 0) during boot.

The vulnerability resides in an ICMP component of EDK II, meaning firmware could be exploited at boot prior to traditional security controls engaging.

While exploitation is not observed universally, experts caution the risk is widespread but not fully confirmed across all devices.

Vendors and open-source maintainers have issued patches and advisories, including AMI’s patch pull request and TianoCore’s advisory, but patching millions of devices remains time-consuming and complex.

The story recalls past UEFI flaws and stresses cautious, coordinated disclosure and the need for vendor-specific guidance as patches roll out.

Ars Technica links the flaw to code used by major firmware suppliers, noting AMI, Insyde, Phoenix, and Project Mu involved or affected, though exact product lists and patch timelines are not yet confirmed.

Although no wild exploits have been seen yet, the public availability of patch code could accelerate exploitation as vendors push updates.

Discloser timeline shows the flaw was discovered by Alex Matrosov and Dan Holmes-Mitra with coordinated disclosure planned for early 2027; TianoCore released an advisory and patch on October 15 and 22 respectively, accelerating public knowledge.

Public advisory and patch details followed AMI’s patch release, and the patch code’s existence lowers barriers for attackers to replicate exploits, increasing remediation urgency.

Disclosures followed an embargo with discovery credited to Matrosov and Holmes-Mitra; patch code and advisory emerged after tips, increasing exploitability for attackers.

Public patch code has been released, and while a fix exists, the fragmented market of UEFI manufacturers means widespread remediation could take months.