Critical severity · published Oct 22, 2026
CVE-2026-97631
Pre-boot RCE in EDK II PXE driver
New
9.5
CVSS
0.4%
EPSS
No
On KEV
Description
EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds
Write”, Classic
Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability
can lead to arbitrary
code execution. It could also impact
Confidentiality,
Integrity,
and Availability.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 37% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ED
EDK2 · TianoCore
through edk2-stable202608 · source: vendor
In the news
VulnerabilityCritical
CVE-2026-97631: 16-Year-Old UEFI Flaw Threatens Servers
CVE-2026-97631: A 16-year-old UEFI flaw (CVSS score of 9.5/10) enables pre-OS code execution. Exposed servers need firmware patches and checks. A critical flaw, tracked as CVE-2026-97631 (CVSS score of 9.5), in the firmware that boots most of the world’s servers is now public, and the patch details came out months early. The bug affects TianoCore […]
Oct 28, 2026·Security Affairs
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-97631
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-97631
github.com
https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m
More from EDK2
9.8
CVE-2026-111497
Out-of-Bounds Write in Google Brotli Decoder
9.8
CVE-2021-38578
Existing CommBuffer checks in SmmEntryPoint will not catch underflow when computing BufferSize
8.8
CVE-2025-2486
UEFI Shell accessible in AAVMF with Secure Boot enabled on Ubuntu
8.8
CVE-2023-45235
EDK2's Network Package is susceptible to a buffer overflow vulnerability when handling Server ID option from a DHCPv6 proxy Advertise message
8.8
CVE-2023-45234
EDK2's Network Package is susceptible to a buffer overflow vulnerability when processing DNS Servers option from a DHCPv6 Advertise message