CVE-2026-97631, rated CVSS v4.0 9.5, is a buffer-overflow and out-of-bounds write flaw in the TianoCore EDK II PXE Base Code driver (NetworkPkg/UefiPxeBcDxe), in ICMP error-message handling for IPv4 and IPv6. TianoCore disclosed it on 22 October 2026, and an upstream fix was merged via pull request 13302 on 15 October 2026.

Before the defences load

An unauthenticated attacker able to send unicast ICMP error messages to a machine actively PXE-booting can trigger memory corruption. With knowledge of the target firmware, that could allow code execution in the DXE phase, before the operating system, Secure Boot and TPM protections load.

Local network access required

AMI, Insyde, Phoenix and Microsoft's Project Mu build on the affected reference code, but the number of vulnerable systems is unknown and vendor firmware availability remains unconfirmed. The key limitation is that the attacker needs local-network access: on its own, this does not give an outsider a way into a network.

No evidence of exploitation in the wild had been reported as of 27 October 2026, and the reported payload lacks persistence, running once per boot. The practical risk is therefore concentrated on machines that boot over the network on untrusted local networks.

Sources: Undercode News and GBHackers.