Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-97631: EDK2 BIOS driver can let remote attackers run code
CVE-2026-97631 · published 7 days ago
Summary
The basic input‑output system (BIOS) component called the PXE driver in the EDK2 firmware can be tricked into writing data outside its intended memory area, which can let an attacker who can reach the computer before it boots to run any program they choose. This could let them see or change data and disrupt the system. Install the latest firmware updates from your hardware vendor or apply the patches provided by the EDK2 project to fix the issue.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | tianocore | edk2 | <= edk2-stable202608 |
| Debian:12 | debian | edk2 | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | edk2 | All versions |
| Ubuntu:26.10 | canonical | edk2-hwe | All versions |
Original advisory text
Pre-boot RCE in EDK II PXE driver
EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality, Integrity, and Availability.
References
- https://github.com/tianocore/edk2/commit/560ed9b5b146ed622d7eb7c40254a9099bd65b8... Third Party Advisory
- https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m
- http://www.openwall.com/lists/oss-security/2026/10/28/4
- https://arstechnica.com/security/2026/10/code-execution-flaw-in-uefi-firmware-th...
- https://github.com/microsoft/mu_basecore/pull/1989
- https://github.com/microsoft/mu_basecore/pull/1990
- https://news.ycombinator.com/item?id=50265393
- https://ubuntu.com/security/CVE-2026-97631 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-97631 Third Party Advisory
- https://github.com/tianocore/edk2/commit/14cdbb86a1a4f9bcce0d6cb78b04af58f226cf4... Third Party Advisory
- https://github.com/tianocore/edk2/commit/fa789071ff0b29f1e568bfe153ef7f3d76bd60e... Third Party Advisory
- https://github.com/tianocore/edk2/pull/13302 Third Party Advisory
- https://github.com/tianocore/edk2/security/advisories/ghsa-99cj-7hg9-mp4m Third Party Advisory
- https://security-tracker.debian.org/tracker/cve-2026-97631 Third Party Advisory
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1151853 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-97631 Vendor Advisory
Severity
9.9
Critical
Type
CWE-120Classic Buffer Overflow
CWE-131Incorrect Calculation of Buffer Size
CWE-787Out-of-bounds Write
Timeline
Published22 Oct 2026
Updated29 Oct 2026
First seen22 Oct 2026
Sources
CVE-2026-97631 · NVD
CVE-2026-97631 · MITRE
DEBIAN-CVE-2026-97631 · OSV
UBUNTU-CVE-2026-97631 · OSV
Track software like this
Free during beta