TianoCore EDK II PXE Pre-Boot RCE (CVE-2026-97631)

TianoCore describes CVE-2026-97631 as a "Pre-boot RCE in EDK II PXE driver". It rates the flaw Critical, with a CVSS v4.0 score of 9.5. The vector is AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H. Red Hat scores it 8.8 under CVSS 3.1.

The CVE record lists CWE-120, CWE-131 and CWE-787. The advisory credits Alex Matrosov and Dan Holmes-Mitra for finding the flaw.

How the Bug Works

During a network boot, the PXE Base Code driver (NetworkPkg/UefiPxeBcDxe) keeps a receive request open for ICMP error messages. It copies each message into a fixed 504-byte field named Mode.IcmpError. The advisory says the bounds handling is wrong in both the IPv4 and the IPv6 handler.

A message longer than 504 bytes is still copied. The driver also moves the destination pointer by the cumulative length instead of the length of each fragment. An oversized message therefore writes attacker-controlled bytes past the end of the field.

What an Attacker Gets

TianoCore says the attacker is unauthenticated. The attacker only has to deliver a unicast ICMP error message addressed to the client's IP address, "from any network distance". The exposure window is the length of the PXE boot, over IPv4 or IPv6.

The advisory names two outcomes. The first is a CPU exception in the DXE core on the next ICMP error, so the boot hangs and OS provisioning or recovery fails.

The second applies to an attacker who knows the target firmware build. That attacker can plant a counterfeit event in the same packet, and CoreSignalEvent() then dispatches attacker-supplied bytes in the DXE phase. This is ring 0, before any OS security control exists.

Where Reports Differ

Ars Technica quotes Jesse Michael of Eclypsium, who says an exploit has to be tuned for each target model, version and configuration, because the memory addresses change between them. Ars also writes that a malicious insider or an attacker with low-level access to a local network can send the message. The advisory says "any network distance". Both agree that the message must arrive while the target is PXE booting.

What Our Checks Showed

We are not saying this flaw is exploited. A public pull request, #13200, opened on 28 September, already carried the CVE id in its title and described the root cause. TianoCore closed it unmerged on 14 October.

Ars Technica writes that public patch code makes it easier for skilled attackers to learn how the bug is triggered. Our news post on the vendor patch status tracks who has a fix.

The CVE record lists TianoCore EDK2 (package NetworkPkg) from version 0 up to and including edk2-stable202608 as affected. The advisory names "EDK II master as of 2026-09-14" and gives the patched versions as "Not patched currently".

The advisory ties the exposure to a PXE boot, so a machine that never network boots does not open that window. This is our reading. Ars Technica reports that machines which boot only from disk are not affected and that the firmware must be built on EDK II.

The fix is pull request #13302, merged into the master branch on 15 October 2026. The newest stable tag, edk2-stable202608, is dated 21 August 2026, so no stable release contains the fix yet.

Distribution trackers list the edk2 and ovmf packages as affected. Red Hat lists RHEL 8, 9 and 10 with no erratum. Debian lists bookworm, trixie and forky with no fixed version. SUSE shows the state Pending.

OVMF is the EDK II based UEFI firmware for virtual machines. Firmware makers must build the fix into their own firmware and ship it as a BIOS or UEFI update.