Live › vulnerability › CVE-2026-97631
Go to dashboardPre-boot RCE in EDK II's PXE Base Code driver (NetworkPkg/UefiPxeBcDxe). The IPv4 and IPv6 ICMP error handlers (PxeBcIcmpErrorDpcHandle, PxeBcIcmp6ErrorDpcHandle) overflow the fixed 504-byte Mode.IcmpError field. An unauthenticated attacker who can send ICMP errors to a machine while it PXE-boots can hang the boot. With knowledge of the firmware build, the attacker can get DXE-phase code execution before Secure Boot or measured boot. All stable tags through edk2-stable202608 are affected. No stable tag contains the fix yet. The fix is in master (PR #13302, fa78907) and firmware vendors must backport it. NVD has deferred the record and it has no CPE data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| edk2 | vendor | all stable tags through edk2-stable202608; master as of 2026-09-14 | – |
| edk2 | vendor | all stable tags through edk2-stable202608; master before fa78907 (2026-10-15) | – |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality, Integrity, and Availability.
This page as .md · .json · in your agent: get_signal("CVE-2026-97631")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.