Critical UEFI Firmware Buffer Overflow (CVE‑2026‑97631) Enables Pre‑Boot Code Execution
What It Is — A buffer‑overflow flaw in the open‑source TianoCore EDK II firmware codebase (used to build UEFI firmware) allows an unauthenticated remote attacker to corrupt DXE‑phase memory during PXE network boot. By sending oversized ICMP error packets, the attacker can overwrite adjacent memory and execute arbitrary code before the operating system loads, bypassing Secure Boot or measured boot checks. The vulnerability is tracked as CVE‑2026‑97631 and has a vendor‑assigned severity of 9.5 / 10. A fix was merged into the EDK II source on 15 Oct 2026, but no patched binary releases are yet available for the affected Debian packages (Bookworm, Trixie, Forky, Sid).
Affected Products — All devices that ship with UEFI firmware built from the vulnerable EDK II source, including many x86 servers, workstations, and embedded systems that use PXE boot (e.g., Debian‑based distributions).
Why It Matters for Trust & Control Assurance — The flaw tests the control objective of maintaining firmware integrity and secure boot processes; organizations must demonstrate that firmware is verified, monitored, and promptly updated. Capability focus: CONTROL_MAPPING.
Recommended Actions
- Inventory all assets that use UEFI firmware built from TianoCore EDK II.
- Verify firmware version against the list of vulnerable Debian packages.
- Apply vendor‑supplied firmware updates as soon as they are released; in the interim, disable PXE/network boot on production systems.
- Enable Secure Boot and measured boot where supported, and deploy continuous firmware‑integrity monitoring.
- Document the remediation steps and retain evidence for audit purposes.
Source: DataBreachToday