Code-execution flaw in UEFI firmware threatens most servers on planet Earth
Critical flaw in EDK2 allows attackers to execute code early in the boot process.
A critical vulnerability has been discovered in the UEFI firmware used in most servers worldwide, posing a significant threat to defenders. With a severity rating of 9.5 out of 10, the flaw exists within the TianoCore EDK II, an open-source codebase utilized by hardware manufacturers and cloud providers to develop UEFI firmware during the boot-up sequence.
The UEFI Forum representative once described EDK2 as the preeminent solution for UEFI specifications. Almost all UEFI suppliers, such as AMI, Insyde, and Phoenix, heavily rely on the reference code. Microsoft's Project Mu also incorporates the vulnerable component. The weakness, identified as CVE-2026-97631, is a memory-corruption flaw in an ICMP component that can be exploited by attackers to execute malicious code before the operating system and firmware can apply security measures like Secure Boot.
This process establishes a chain of trust for all code and the Trusted Platform Module (TPM) during boot. Although the initial payloads delivered by CVE-2026-97631 have no persistence, they provide attackers with an opportunity to install further malicious payloads that run each time early in the boot process.
Written by urgent.news from Ars Technica's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
