---
id: "CVE-2026-97631"
kind: "vulnerability"
aliases: ["CVE-2026-97631"]
title: "EDK2 firmware: remote buffer overflow can lead to code execution"
severity: "critical"
cvss: 9.5
epss: 0.00432
exploited: false
status: "open"
category: "infrastructure"
products: [{"name": "edk2", "fixed": [], "affected": "all stable tags through edk2-stable202608; master as of 2026-09-14", "ecosystem": "vendor"}, {"name": "edk2", "fixed": [], "affected": "all stable tags through edk2-stable202608; master before fa78907 (2026-10-15)", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["edk2", "firmware", "infrastructure", "network-boot", "ovmf", "pxe", "servers", "uefi", "workstations"]
not_affected_if: []
published_at: "2026-10-22T17:17:02+00:00"
first_seen_at: "2026-10-23T21:57:31+00:00"
updated_at: "2026-10-24T07:15:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-97631", "first_seen_at": "2026-10-23T21:57:31+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:22:58+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:48:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-97631", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# EDK2 firmware: remote buffer overflow can lead to code execution

Pre-boot RCE in EDK II's PXE Base Code driver (NetworkPkg/UefiPxeBcDxe). The IPv4 and IPv6 ICMP error handlers (PxeBcIcmpErrorDpcHandle, PxeBcIcmp6ErrorDpcHandle) overflow the fixed 504-byte Mode.IcmpError field. An unauthenticated attacker who can send ICMP errors to a machine while it PXE-boots can hang the boot. With knowledge of the firmware build, the attacker can get DXE-phase code execution before Secure Boot or measured boot. All stable tags through edk2-stable202608 are affected. No stable tag contains the fix yet. The fix is in master (PR #13302, fa78907) and firmware vendors must backport it. NVD has deferred the record and it has no CPE data.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:edk2 affected all stable tags through edk2-stable202608; master as of 2026-09-14 fixed ?
- vendor:edk2 affected all stable tags through edk2-stable202608; master before fa78907 (2026-10-15) fixed ?

## How to check

No version command can tell you. Check whether your machines PXE/network boot over IPv4 or IPv6 (firmware setup, provisioning workflow). Ask your OEM or BIOS vendor whether their firmware carries the fix for CVE-2026-97631. For VMs (OVMF/ArmVirtPkg), check whether your distro's edk2/ovmf package backports PR #13302; the package version may not change.

## Fix

No first fixed stable tag exists yet; the newest is edk2-stable202608 and is vulnerable. The fix is PR #13302 (commit fa789071ff0b29f1e568bfe153ef7f3d76bd60e4) in master. Take the next edk2-stable tag (expected around November 2026, unconfirmed) or an OEM/distro firmware that backports it. Until then, disable PXE/network boot where unneeded, or isolate PXE on a dedicated segment and block inbound ICMPv4 types 3, 11, 12 and ICMPv6 types 1-4 from outside it.

## Timeline

- 2026-10-23T21:57:31+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-97631
- 2026-10-23T22:22:58+00:00 analyst — Read TianoCore advisory GHSA-99cj-7hg9-mp4m plus Severity Daily analysis. Bug is in NetworkPkg/UefiPxeBcDxe ICMP error handlers. Fix is merged in master (PR #13302, commit fa78907) but no stable tag carries it. No exploitation or PoC found; X shows 1 post in 7 days. Severity unchanged.
- 2026-10-23T22:48:27+00:00 analyst — Answered the triage question. The affected component is NetworkPkg/UefiPxeBcDxe (PXE ICMP error handlers). No fixed stable tag exists: the releases page still ends at edk2-stable202608 (2026-08-21). The fix is PR #13302, which I read, merged to master 2026-10-15 as fa78907. It adds boundary checks and ZeroMem and has unit tests. No exploitation or PoC found.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-97631

## Documents

- [advisory] GHSA-99cj-7hg9-mp4m: Pre-boot RCE in EDK II PXE driver https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m
- [describes] Severity Daily: EDK2 9.5 pre-boot RCE fixed in master, no stable tag https://severitydaily.com/edk2-cve-2026-97631-9-5-pxe-icmp-pre-boot-rce-merged-october-15-no-stable-tag-not-patched-currently/
- [fix] edk2 PR #13302: Fix ICMP buffer overflow in UefiPxeBcDxe (CVE-2026-97631) https://github.com/tianocore/edk2/pull/13302

## From the sources

EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds
Write”, Classic
Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability
can lead to arbitrary
code execution. It could also impact
Confidentiality,
Integrity,
and Availability.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_