Field Notes / Vulnerability
The UEFI flaw in “most servers on Earth” opens only while a machine boots from the network.
CVE-2026-97631 is a 9.5-rated bug in the EDK II network boot driver that almost every firmware vendor builds on. One packet can run code before the operating system and Secure Boot. The window is the PXE boot, and the fix will take months to reach your hardware. Here is how far the headline overstates it, where it understates it, and what to change this week.
01 What the flaw is
machine that boots from the network runs its own small network stack inside the firmware. EDK II’s version stores the last ICMP error message in a 504-byte field. The copy code gets the bounds and the pointer arithmetic wrong in both the IPv4 and IPv6 handlers, so a larger message writes past the end TianoCore advisory .
The attacker sends one unicast ICMP error to the booting machine. The reliable result is a hung boot. With the exact firmware build known, the attacker plants a fake event in the same packet and the firmware executes it at its highest privilege level. That code runs before Secure Boot and measured boot look at anything. It does not persist on its own. It can install something that does Ars Technica .
02 Most servers on Earth?
The code is on most servers. The window is not open on most servers. A production machine that boots from disk and reboots for maintenance never asks the network for a boot file. The exposed moments are the ones where it does: bare-metal rebuilds in a data centre, laptop imaging, thin clients, and machines left with network boot first in the boot order.
The headline understates one thing. The fix was merged upstream on 15 October through pull request 13302 PR 13302 , ahead of a coordinated disclosure the researchers, Alex Matrosov of Anthropic and Dan Holmes of Google, had set for January. The public fix shows attackers exactly where the bug is. Every firmware vendor and every hardware maker now has to ship its own update, model by model Cyber Security News . Older hardware waits longest.
03 What to change this week
- List where you PXE boot: provisioning VLANs, imaging servers, bare-metal pipelines, thin clients
- Keep PXE on an isolated provisioning network with no user, guest or general server traffic routed in
- Disable network boot where nobody uses it, and put the local disk first everywhere else
- Block unexpected ICMP error messages towards provisioning ranges
- Ask every hardware vendor, per model, for the firmware release that includes EDK II PR 13302, and schedule it
If you run a hosting or colocation estate, the provisioning network is the asset to defend. If you image endpoints, so is the imaging network. In both cases, the question is the same one an attacker asks first: from the devices already inside, what can I reach? Get that answered with proof. Enterprise-grade. Not enterprise-priced.
References
Sources
- TianoCore EDK II. Security advisory GHSA-99cj-7hg9-mp4m, “Pre-boot RCE in EDK II PXE driver”, CVE-2026-97631. 22 October 2026. github.com
- Dan Goodin, Ars Technica. “Code-execution flaw in UEFI firmware affects most servers on planet Earth.” 27 October 2026. arstechnica.com
- Cyber Security News. “Critical UEFI Firmware Flaw Could Expose Millions of Servers to Pre-Boot Code Execution.” October 2026. cybersecuritynews.com
- TianoCore EDK II. Pull request #13302. github.com