Vulnerability · Published Oct 22, 2026 · Assigned by TianoCore
CVE-2026-97631Pre-boot RCE in EDK II PXE driver
Critical 9.5
In plain English
A critical-severity buffer overflow in EDK2 from TianoCore. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality, Integrity, and Availability.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | edk2 | no fix listed | DEBIAN-CVE-2026-97631 |
| Debian:13 | edk2 | no fix listed | DEBIAN-CVE-2026-97631 |
| Debian:14 | edk2 | no fix listed | DEBIAN-CVE-2026-97631 |
| Ubuntu:22.04:LTS | edk2 | no fix listed | UBUNTU-CVE-2026-97631 |
| Ubuntu:24.04:LTS | edk2 | no fix listed | UBUNTU-CVE-2026-97631 |
| Ubuntu:26.04:LTS | edk2 | no fix listed | UBUNTU-CVE-2026-97631 |
| Ubuntu:26.10 | edk2 | no fix listed | UBUNTU-CVE-2026-97631 |
| Ubuntu:26.04:LTS | edk2-hwe | no fix listed | UBUNTU-CVE-2026-97631 |
| Ubuntu:26.10 | edk2-hwe | no fix listed | UBUNTU-CVE-2026-97631 |
Affected products (as reported)
Weakness: CWE-120, CWE-131, CWE-787 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
References
- https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m
- https://arstechnica.com/security/2026/10/code-execution-flaw-in-uefi-firmware-threatens-most-servers-on-planet-earth/
- https://news.ycombinator.com/item?id=50265393
- https://github.com/microsoft/mu_basecore/pull/1990
- https://github.com/microsoft/mu_basecore/pull/1989
- http://www.openwall.com/lists/oss-security/2026/10/28/4