Flaw in EDK II could allow code execution before the operating system loads

A critical buffer overflow vulnerability in EDK II UEFI firmware, classified as CVE-2026-97631, impacts network boot operations in firmware versions up to edk2-stable202608. This pre-operating system execution flaw allows attackers to execute their own code before the operating system and Secure Boot protection are initialized. No prior device access or password is required to exploit the vulnerability as long as the attacker can communicate with the device during the boot process.

The flaw enables attackers to manipulate the size check during network boot status and error message transmission, causing the system to hang and fail to complete the boot process. To be successful, the attacker must tailor the attack to the specific boot software of the affected device. Once executed, the malicious code operates before the operating system and Secure Boot protections are loaded, but does not persist on the device after a reboot.

EDK II, an open-source software utilized by independent vendors like AMI, Insyde, and Phoenix, as well as Microsoft's Project Mu, is affected by the flaw. While not directly targeted, versions up to and including edk2-stable202608, released on August 21, are vulnerable. Intel and Arm have not reported any commercial products or product lines being directly impacted by the issue.

The vulnerability was discovered by Alex Matrosov of Anthropic and Dan Holmes-Mitra of Google and made public early on September 28 through a code change proposal containing the fix and its description. TianoCore published a warning about the issue on October 22, and the fix was added to the core development code on October 15, although it has not yet been released in a stable release.

Although there is currently no evidence that the issue has been used in real attacks, device administrators without a need for network boot can disable it to mitigate the risk.