{"id":"CVE-2026-97631","kind":"vulnerability","aliases":["CVE-2026-97631"],"related":[],"title":"EDK2 firmware: remote buffer overflow can lead to code execution","description":"EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds\nWrite”, Classic\nBuffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability\ncan lead to arbitrary\ncode execution. It could also impact\nConfidentiality,\nIntegrity,\nand Availability.","summary":"Pre-boot RCE in EDK II's PXE Base Code driver (NetworkPkg/UefiPxeBcDxe). The IPv4 and IPv6 ICMP error handlers (PxeBcIcmpErrorDpcHandle, PxeBcIcmp6ErrorDpcHandle) overflow the fixed 504-byte Mode.IcmpError field. An unauthenticated attacker who can send ICMP errors to a machine while it PXE-boots can hang the boot. With knowledge of the firmware build, the attacker can get DXE-phase code execution before Secure Boot or measured boot. All stable tags through edk2-stable202608 are affected. No stable tag contains the fix yet. The fix is in master (PR #13302, fa78907) and firmware vendors must backport it. NVD has deferred the record and it has no CPE data.","severity":"critical","cvss":9.5,"epss":0.00432,"exploited":false,"exploited_at":null,"products":[{"name":"edk2","fixed":[],"affected":"all stable tags through edk2-stable202608; master as of 2026-09-14","ecosystem":"vendor"},{"name":"edk2","fixed":[],"affected":"all stable tags through edk2-stable202608; master before fa78907 (2026-10-15)","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["edk2","firmware","infrastructure","network-boot","ovmf","pxe","servers","uefi","workstations"],"not_affected_if":[],"how_to_check":"No version command can tell you. Check whether your machines PXE/network boot over IPv4 or IPv6 (firmware setup, provisioning workflow). Ask your OEM or BIOS vendor whether their firmware carries the fix for CVE-2026-97631. For VMs (OVMF/ArmVirtPkg), check whether your distro's edk2/ovmf package backports PR #13302; the package version may not change.","fix":"No first fixed stable tag exists yet; the newest is edk2-stable202608 and is vulnerable. The fix is PR #13302 (commit fa789071ff0b29f1e568bfe153ef7f3d76bd60e4) in master. Take the next edk2-stable tag (expected around November 2026, unconfirmed) or an OEM/distro firmware that backports it. Until then, disable PXE/network boot where unneeded, or isolate PXE on a dedicated segment and block inbound ICMPv4 types 3, 11, 12 and ICMPv6 types 1-4 from outside it.","status":"open","published_at":"2026-10-22T17:17:02+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-23T22:32:23+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"infrastructure","confidence":0.9,"triage":{"at":"2026-10-23T22:32:23Z","model":"claude-haiku-5-5","output":{"fix":"Update to an EDK2 build that includes the fix; the sources say master as of 2026-09-14 is fixed, but the first fixed stable tag is unknown.","reach":"network","title":"EDK2 firmware: remote buffer overflow can lead to code execution","impact":"high","summary":"EDK2, the open-source UEFI firmware base used in BIOS and OVMF images, has out-of-bounds write and buffer overflow flaws that a remote user can trigger. Successful exploitation can lead to arbitrary code execution, and the sources also list confidentiality, integrity and availability impact.","category":"infrastructure","who_cares":["edk2","uefi","ovmf","pxe","servers","workstations"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Arbitrary code execution at firmware level before the operating system loads.","analyst_note":"Find the first fixed EDK2 stable tag and the exact affected component at https://nvd.nist.gov/vuln/detail/CVE-2026-97631.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000909,"input_tokens":3034,"output_tokens":1211,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the first fixed EDK2 stable tag and the exact affected component at https://nvd.nist.gov/vuln/detail/CVE-2026-97631.","search":"'-2026':12A,15A '-97631':13A,16A '13302':122B '504':55B 'access':168C 'affect':108B 'also':182C 'arbitrari':177C 'attack':61B,86B 'avail':187C 'backport':128B 'base':39B 'bio':146C 'boot':24B,32B,74B,78B,96B,99B 'bound':155C 'buffer':4A,158C,164C 'build':84B 'byte':56B 'calcul':162C 'caus':151C 'classic':157C 'code':9A,40B,92B,178C 'confidenti':184C 'contain':112B,142C 'could':181C 'cpe':139B 'cve':11A,14A 'data':140B 'defer':132B 'driver':41B 'dxe':90B 'dxe-phas':89B 'edk':35B 'edk2':1A,17A,18A,19B,105B,141C 'edk2-stable202608':104B 'error':48B,66B 'execut':10A,93B,179C 'exploit':170C 'fa78907':123B 'field':58B 'firmwar':2A,20B,83B,125B 'fix':54B,114B,117B 'get':88B 'handler':49B 'hang':76B 'icmp':47B,65B 'ii':36B 'impact':183C 'incorrect':161C 'infrastructur':21B 'integr':185C 'ipv4':44B 'ipv6':46B 'knowledg':80B 'lead':7A,175C 'machin':69B 'master':120B 'may':150C 'measur':98B 'mode.icmperror':57B 'must':127B 'network':23B 'network-boot':22B 'networkpkg/uefipxebcdxe':42B 'nvd':130B 'out-of-bound':152C 'overflow':5A,52B,159C 'ovmf':25B 'phase':91B 'pr':121B 'pre':31B 'pre-boot':30B 'pxe':26B,38B,73B 'pxe-boot':72B 'pxebcicmp6errordpchandle':51B 'pxebcicmperrordpchandl':50B 'rce':33B 'record':134B 'remot':3A,167C 'secur':95B 'send':64B 'server':27B 'size':165C 'stabl':101B,110B 'stable202608':106B 'success':169C 'tag':102B,111B 'uefi':28B 'unauthent':60B 'user':149C 'vendor':126B 'vulner':144C,173C 'workstat':29B 'write':156C 'yet':115B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T17:17:02+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"infosec@edk2.groups.io","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97631","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97631","severity":null,"published_at":"2026-10-22T17:17:02+00:00","modified_at":"2026-10-22T17:40:46+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-97631:210","url":null,"severity":null,"published_at":"2026-10-23T22:22:58+00:00","modified_at":"2026-10-23T22:22:58+00:00","first_seen_at":"2026-10-23T22:22:58+00:00","fetched_at":"2026-10-23T22:22:58+00:00","note":"Read TianoCore advisory GHSA-99cj-7hg9-mp4m plus Severity Daily analysis. Bug is in NetworkPkg/UefiPxeBcDxe ICMP error handlers. Fix is merged in master (PR #13302, commit fa78907) but no stable tag carries it. No exploitation or PoC found; X shows 1 post in 7 days. Severity unchanged."},{"source":"analyst","external_id":"CVE-2026-97631:301","url":null,"severity":null,"published_at":"2026-10-23T22:48:27+00:00","modified_at":"2026-10-23T22:48:27+00:00","first_seen_at":"2026-10-23T22:48:27+00:00","fetched_at":"2026-10-23T22:48:27+00:00","note":"Answered the triage question. The affected component is NetworkPkg/UefiPxeBcDxe (PXE ICMP error handlers). No fixed stable tag exists: the releases page still ends at edk2-stable202608 (2026-08-21). The fix is PR #13302, which I read, merged to master 2026-10-15 as fa78907. It adds boundary checks and ZeroMem and has unit tests. No exploitation or PoC found."},{"source":"epss","external_id":"CVE-2026-97631","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97631","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[{"id":1409,"url":"https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m","title":"GHSA-99cj-7hg9-mp4m: Pre-boot RCE in EDK II PXE driver","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1410,"url":"https://severitydaily.com/edk2-cve-2026-97631-9-5-pxe-icmp-pre-boot-rce-merged-october-15-no-stable-tag-not-patched-currently/","title":"Severity Daily: EDK2 9.5 pre-boot RCE fixed in master, no stable tag","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1608,"url":"https://github.com/tianocore/edk2/pull/13302","title":"edk2 PR #13302: Fix ICMP buffer overflow in UefiPxeBcDxe (CVE-2026-97631)","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}