EDK II, an open-source project from Tianocore, has carried a critical security flaw for 16 years. Many vendors use EDK II as the base for their UEFI firmware. The flaw lets attackers inject malicious code remotely that runs before the operating system even starts. The number of affected servers is said to be huge, and the details leaked out by accident.
Memory corruption during PXE boot
The flaw is tracked as CVE-2026-97631 and carries a CVSS score of 9.5, which makes it critical. According to the description, an attacker only has to send an ICMP error message to a vulnerable system during the PXE boot process, with no authentication required. That triggers memory corruption, and malicious code can end up running before the operating system and before Secure Boot.
The root cause is writes that go beyond an intended 504-byte buffer. Attackers only need access to the local network and the target server's IP address. The attack works over both IPv4 and IPv6.
Embargo broken
Ars Technica reports that two researchers from Anthropic and Google found the flaw. Details were supposed to stay under wraps until January 2027. An affected vendor apparently published a pull request on GitHub by mistake, containing the code fix and further details, and broke the embargo. Since attackers can build an exploit quickly from such information with the help of AI, Tianocore disclosed the flaw early too.
The report names AMI, Insyde and Phoenix among the affected UEFI vendors. Project Mu, a fork of EDK II maintained by Microsoft, is also said to contain the vulnerable code. One quote says "most servers on planet Earth" are affected. Even though the fix is publicly visible, the patch situation remains unclear for now because of the broken embargo.
Patches have to come from hardware vendors
Before admins can patch, hardware vendors first have to ship firmware updates. Because the flaw is 16 years old, many older servers are probably affected that are long out of support and will likely never get a fix. Ask your device vendors whether your systems are affected and when patches will be available.
Not an easy win for attackers
Exploitation is not trivial. A researcher from Eclypsium points out that attackers have to guess certain addresses inside the target system. A working exploit cannot simply be reused against other targets: it has to be tailored to each model, version and configuration, because the addresses depend on those factors.
The flaw is also limited to PXE boot. Only systems that fetch network resources during startup are vulnerable, which mostly happens in corporate networks. Regular machines that boot from a hard disk or SSD cannot be attacked through CVE-2026-97631.