16-Year-Old Firmware Flaw Could Let Attackers Run Code Before Secure Boot on Network-Booting Servers

A critical flaw that has existed for 16 years has been found in EDK II, the open-source code most hardware makers use to build UEFI firmware. UEFI is the software that runs first when a computer starts, before the operating system. The flaw, tracked as CVE-2026-97631, can let an attacker run code before Secure Boot and other startup defences load. It only applies while a machine is booting over the network, a method known as PXE boot. TianoCore, the project behind EDK II, published an advisory on October 22 and rated the flaw 9.5 out of 10.

The problem is a buffer overflow in the network-boot code. The driver copies small error messages from network devices into a fixed 504-byte area of memory, but the size checks are wrong in both the IPv4 and IPv6 versions. A longer message spills into nearby memory. An attacker needs no password or existing access, but must reach the machine during the short boot window. Red Hat and SUSE, which ship the affected code, rate it as exploitable from an adjacent network position rather than across the open internet.

The most likely result is a crash that stops the machine from starting. Running attacker code is much harder and less reliable, because the advisory says it requires knowing the exact firmware build. A code fix exists, but no stable EDK II release contains it yet and the advisory lists no patched version, so most users have nothing to install today.