Critical UEFI Firmware Flaw Exposes Most Servers to Pre-Boot Code Execution

A severe code-execution vulnerability in boot-time firmware used by most of the world's server vendors and data centers is now public, and defenders are scrambling to respond.

Tracked as CVE-2026-97631 and rated 9.5 out of 10 for severity, the flaw sits in TianoCore EDK II, the open source codebase hardware makers and cloud providers rely on to build the UEFI firmware that runs during boot. Virtually all UEFI suppliers, including AMI, Insyde and Phoenix, use the reference code extensively, and Microsoft's hardened EDK2 fork, Project Mu, used the vulnerable component as well.

The bug is a memory-corruption flaw in an ICMP component that attackers can exploit to run malicious code before the operating system and defenses like Secure Boot and the Trusted Platform Module load. While the final payloads have no persistence, they can open the door to other payloads that run early in every boot.

Alex Matrosov of Anthropic and Dan Holmes of Google discovered the flaw and had arranged a coordinated disclosure for January. That plan unraveled after AMI published a pull request detailing the vulnerability and including a code fix last month; TianoCore Project members then issued a public advisory last week. With patch code now public, advanced attackers can readily learn how to trigger the flaw and build working exploits.

The vulnerability is a 16-year-old buffer overflow in the PXE-Base Code driver, which lets servers and storage equipment boot from code downloaded over a local network. Because the driver doesn't enforce a 504-byte memory copy limit, an attacker with low-level access to a local network can send an ICMP error message that overwrites adjacent data and corrupts the UEFI module running on the CPU. Exploits run in ring 0, the CPU's most privileged level, and can bypass attestation processes.

There are limits. Control over a local network is a prerequisite, which likely restricts exploitation to insiders or attackers such as nation-states or ransomware operators who already have a foothold. There is no evidence the flaw provides an initial entry point into a network, and exploits must be tuned to each target model, version and configuration. It also doesn't affect home and small office users or anyone who boots solely from disk drives.

Intel said none of its commercial products currently under security support are known to be affected, adding that it does not include the affected EDK2 functionality in its reference code, though OEMs may integrate it. Arm said the CVE is not directly applicable to its product portfolio. AMD, Phoenix Technologies, AMI, Microsoft and Amazon did not respond to questions.

HD Moore, creator of Metasploit and chief research officer at Dragos, said an attacker could use the bug to hijack program flow while the boot process still has access to sensitive components like the TPM, potentially breaking disk encryption where an attacker has short-term network access. Given how widespread the code is, he said it's likely a "forever" bug that will live on in end-of-support systems.

Those affected should check with their firmware maker for guidance, consider temporarily disabling network boot, keep security features like TPM and Secure Boot enabled where possible, and monitor logs for signs of exploitation attempts.

Source: Wired