Most Servers on the Planet Are Vulnerable to This Firmware Code-Execution Flaw

Defenders crossed the satellite look the load of responding to yet another botched code-execution vulnerability, this clip successful boot-time firmware utilized by astir of the world’s server vendors and information centers.

The vulnerability, with a severity standing of 9.5 retired of 10, resides successful the TianoCore EDK II, an unfastened root codebase that hardware makers and unreality providers usage to make the UEFI firmware that runs during the boot-up sequence. Last year, a typical of the UEFI Forum called EDK2 the “preeminent solution / implementation of the UEFI specifications.” Virtually each UEFI suppliers (sometimes inactive called IBVs oregon autarkic BIOS vendors), including AMI, Insyde, and Phoenix, usage the notation codification extensively. Project Mu, Microsoft’s hardened EDK2 fork, utilized the codification containing the susceptible constituent arsenic well.

The vulnerability, tracked arsenic CVE-2026-97631, is simply a memory-corruption flaw successful an ICMP constituent that attackers tin exploit to execute malicious codification that runs earlier the operating strategy and firmware tin instrumentality defenses similar Secure Boot, which establishes a concatenation of spot for each code, including the Trusted Platform Module (TPM), loaded during boot. While last payloads delivered by CVE-2026-97631 person nary persistence—meaning they tally lone once—they tin springiness attackers a wide opening to instal different payloads that besides tally each clip aboriginal successful the footwear process.

The Cat Has Left the Bag

The parties that discovered CVE-2026-97631—Alex Matrosov of Anthropic and Dan Holmes of Google—had arranged for it to stay nether wraps until a coordinated disclosure that was scheduled for January. AMI, a shaper of motherboards and different hardware, published this propulsion request past period that elaborate the vulnerability and included a codification fix. Once the station came to the attraction of the discovering parties, TianoCore Project members published a public advisory past week.

With publically disposable spot code, it volition beryllium trivial for precocious hackers to larn however the vulnerability is triggered and to physique moving exploits. Further compounding the urgency, patching UEFI codification vulnerabilities successful millions of extremity devices sold and utilized by thousands of hardware makers and unreality providers is cumbersome and time-consuming. Word of the vulnerability comes six days aft different botched disclosure, this 1 involving a critical code-execution vulnerability successful the PHP programming language.

“This vulnerability successful the ICMP parser of the EDK2 web stack is absorbing successful presumption of however it affects the concatenation of spot and the broader ecosystem,” said HD Moore, creator of Metasploit and main probe serviceman astatine information steadfast Dragos. “An attacker intent connected compromising a adjacent endpoint oregon server could usage this bug to hijack programme travel astatine a constituent wherever the footwear process inactive has entree to delicate components, similar the endpoint’s TPM. This could beryllium utilized to break disk encryption for cases wherever an attacker has short-term web entree (and it would beryllium adjacent easier successful a theft scenario).”

CVE-2026-97631 is simply a 16-year-old buffer overflow successful the PXE-Base Code operator (NetworkPkg/UefiPxeBcDxe), which is liable for allowing servers, retention equipment, and different devices to footwear utilizing codification downloaded from a section network. During this process—known arsenic the pre-execution situation boot—the operator uses a web listener to show for ICMP errors. Because the operator doesn’t enforce a representation transcript bounds of 504 bytes, overwriting adjacent data, a malicious insider oregon a hacker who has gained low-level entree to a section web tin nonstop an mistake connection that appends codification past this limit. The IUEFI module moving connected the CPU past becomes corrupted.