Critical UEFI Firmware Flaw CVE-2026-97631 Exposes Global Servers to Pre-OS Attacks

Critical Vulnerability in Global Server Firmware

A severe security flaw has been identified in the Unified Extensible Firmware Interface (UEFI) firmware that boots the majority of servers worldwide. The vulnerability, tracked as CVE-2026-97631, resides in EDK II, an open-source toolkit developed by TianoCore that serves as the foundational codebase for most UEFI firmware implementations. The flaw allows attackers to execute arbitrary code at the processor's highest privilege level before the operating system or security software can intervene.

The discovery was made by researchers Alex Matrosov of Anthropic and Dan Holmes-Mitra of Google. They originally planned to disclose the issue in January 2027. However, the vulnerability was exposed prematurely in September when a public code change by firmware manufacturer American Megatrends (AMI) included the fix and explicitly referenced the CVE number. This early disclosure has accelerated the risk profile, as exploit code is now publicly available before widespread patches are deployed.

Technical Details and Attack Vector

TianoCore assigned the vulnerability a severity score of 9.5 out of 10 in an advisory published on October 22. The bug is located in the driver responsible for Preboot Execution Environment (PXE) network booting. During the boot process, the driver copies incoming ICMP error messages from the network into a fixed 504-byte area of memory. Due to incorrect size validation checks, a crafted ICMP message can exceed this limit, overwriting adjacent memory with attacker-controlled data.

While a single crafted message can cause the system to hang, an attacker with knowledge of the specific firmware build can leverage the memory corruption to execute their own code. This capability bypasses Secure Boot and other pre-boot security features. The National Vulnerability Database (NVD) has classified the issue as critical, highlighting the potential for remote code execution on servers that accept network boot requests.

Global Impact and Security Concerns

The implications of CVE-2026-97631 are significant for global infrastructure. HD Moore, chief research officer at security firm Dragos, noted that the flaw could be used to break disk encryption for cases where an attacker has short-term network access. He emphasized that the attack would be even easier in physical theft scenarios, where an attacker has direct access to the machine's boot process.

Because EDK II is the common foundation for UEFI firmware across various hardware vendors, the vulnerability affects a vast portion of the server market. However, the patching landscape is fragmented. While a fix exists, the time required for different hardware manufacturers to integrate, test, and deploy the update varies significantly. This delay leaves organizations exposed to potential exploitation during the window between public disclosure and patch deployment.

Response and Future Outlook

Security experts warn that the early public release of the patch code provides cybercriminals with a clear roadmap for developing exploits. The combination of a high-severity vulnerability, widespread adoption of the affected firmware, and delayed patching creates a substantial risk window. Organizations are urged to assess their exposure, particularly for servers configured to boot over the network, and prioritize updates as they become available from their respective hardware vendors.

Key takeaways

• CVE-2026-97631 is a critical buffer overflow in the EDK II firmware toolkit used by most servers.
• Researchers from Anthropic and Google discovered the flaw, which allows pre-boot code execution.
• The vulnerability was disclosed early due to a public code change by firmware maker AMI.
• Attackers can exploit the PXE network boot driver to break disk encryption or run arbitrary code.
• Fragmented vendor patching and public exploit code leave global data centers vulnerable for months.