Most Servers on the Planet Are Vulnerable to This Firmware Code-Execution Flaw
The critical flaw in UEFI firmware—used by most server vendors and data centers—allows attackers to execute code early in the boot process.
A significant vulnerability, rated 9.5 out of 10 in severity, has been identified in the TianoCore EDK II, a widely-used open-source codebase for creating UEFI firmware. This flaw, tracked as CVE-2026-97631, is a memory-corruption issue in an ICMP component of the PXE-Base Code driver, which facilitates server and device booting via networked code.
The vulnerability, discovered last year by researchers Alex Matrosov and Dan Holmes, was initially kept under wraps for a coordinated disclosure. The UEFI Forum's representative referred to EDK2 as the "preeminent solution implementation of the UEFI specifications," signifying its widespread adoption. Major UEFI suppliers such as AMI, Insyde, and Phoenix utilize EDK2 extensively, making this flaw particularly concerning.
The vulnerability can be exploited by attackers to execute malicious code before the operating system and firmware implementations, potentially evading defenses like Secure Boot and bypassing Trusted Platform Module (TPM) protections. Once discovered by AMI, a patch was published, but the vulnerability's pervasiveness across millions of devices presents a significant challenge for widespread remediation.
Written by urgent.news from Wired's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
