Servers and other machines that start up over a network face a critical firmware risk, after a flaw in the widely reused EDK II codebase was disclosed that can let an attacker run code before the operating system and its startup defences have loaded.

Why the boot window matters

The flaw, tracked as CVE-2026-97631 and rated 9.5 out of 10, sits in the PXE network-boot driver. During a network boot, the driver listens for ICMP error messages and copies them into a fixed 504-byte field without correctly limiting the length, so an oversized message can overwrite nearby memory. At minimum that can hang the boot. With knowledge of the exact firmware build, an attacker could go further and run code in the early DXE phase, before Secure Boot and TPM-based protections take effect, and then install a payload that runs early on later boots. The catch is scope: the machine must be actively booting over a network, and the attacker must be able to reach it on the local network. Reports stress there is no evidence this gives an outsider a first way into a network on its own, and machines that boot only from a local disk are not affected in this way. EDK II is the reference code behind firmware from suppliers including AMI, Insyde and Phoenix, and Microsoft's Project Mu fork also carried the affected component.

What owners can do now

TianoCore published its advisory on 22 October 2026, after a hardware maker published fix code early and brought forward a disclosure originally planned for January. A code fix exists, but no stable EDK II release containing it was listed at the time of reporting, so most users have no firmware update to install yet. Owners should therefore ask their system or firmware supplier which builds are affected, switch off network boot where it is not needed, keep boot networks segmented from untrusted devices, and watch boot logs for unexplained hangs. Home users who never use network boot need no action beyond normal supplier updates.

Sources: Security Affairs and The Hacker News.