Critical UEFI firmware flaw leaks early, leaving servers waiting for a fix

A critical flaw in the firmware that starts most servers can let an attacker run code before the operating system loads. It sits in EDK II, the open-source code most firmware makers use to build UEFI firmware. TianoCore, which runs EDK II, rated the bug 9.5 out of 10 in an advisory published on 22 October. The flaw is tracked as CVE-2026-97631.

The flaw went public months early. Alex Matrosov of Anthropic and Dan Holmes-Mitra of Google found it. They had planned to disclose it in January 2027, Dan Goodin reported for Ars Technica. In September, a public code change signed off by an engineer at AMI, which makes firmware, described the flaw by its CVE number and included the fix.

“This could be used to break disk encryption for cases where an attacker has short-term network access (and it would be even easier in a theft scenario),” HD Moore, chief research officer at security firm Dragos, told Ars Technica.

How the attack works

The bug sits in the driver that lets a machine boot over a network, a process known as PXE. During that boot, the driver copies incoming ICMP error messages into a fixed 504-byte area of memory. These are small status messages that network devices send back. Its size checks are wrong, so a longer message overwrites nearby memory with data the attacker chooses, the advisory says.

One crafted message can hang the boot. An attacker who knows the exact firmware build can go further and run their own code at the processor’s most privileged level, before Secure Boot checks anything. The advisory says the message can come “from any network distance” while the machine is booting this way.

Researchers who spoke to Ars set limits on that. An attacker needs some control over the local network, which points to insiders or intruders who already have a foothold. Attackers also have to tune each exploit to a specific model and configuration. Red Hat and SUSE rate the flaw as exploitable from an adjacent network, according to The Hacker News. The flaw does not touch machines that boot only from a local disk.

Who is affected

EDK II is the base for firmware from AMI, Insyde and Phoenix, and for Project Mu, Microsoft’s hardened version, according to Ars. Intel told Ars it knows of none of its supported commercial products that the flaw affects, though device makers could add the code. Arm said the flaw does not directly apply to its products. AMD, AMI, Phoenix, Microsoft and Amazon did not answer Ars’s questions.

Red Hat, SUSE and Debian list their EDK II packages as affected and still unfixed, The Hacker News reported. There is no sign of attacks so far. The flaw was not in the catalogue of exploited bugs kept by CISA, the US cybersecurity agency, as of 27 October.

Waiting for a patch

TianoCore merged a fix into the EDK II source code on 15 October, The Hacker News reported. No stable release includes it yet, and the advisory lists no patched version. Microsoft’s Project Mu released builds with the fix on 26 October. Server operators still have to wait for their firmware maker to ship a BIOS or UEFI update.

That update should be simpler than past firmware fixes. Jesse Michael, a principal researcher at firmware security firm Eclypsium, told Ars the bug “can be fixed with a basic code fix,” with no need to revoke security keys. Until then, Ars advises turning off network boot where possible and watching logs for exploit attempts.

Ars called it another botched disclosure, after PHP’s emergency patches on 21 October for two critical flaws that went public early. Attackers are now exploiting both PHP2Shell flaws. Microsoft also shipped emergency .NET fixes for another critical bug this week.