conv.

All stories
SecurityQuiet 14d · day 15

16-year-old UEFI flaw lets attackers run code before Secure Boot on servers

A critical buffer overflow in EDK II affects network-booting servers; a fix exists but no patched stable release is available.

newest coverage 13d agosummary written 11d ago4 pieces7 likes & upvotes Google NewsMastodon

What to know

  • A 16-year-old buffer overflow in EDK II's PXE network-boot code (CVE-2026-97631, rated 9.5 severity) allows pre-boot code execution on servers booting over the network with no authentication required.
  • The vulnerability affects primarily data center and server equipment; home and office users booting from local disks are not impacted.
  • A patch exists but has not been included in any stable release of EDK II as of October 22, leaving most users without a ready-to-install fix.
  • Red Hat and SUSE rate the flaw as exploitable only from adjacent network position, not across the internet; Intel states none of its commercial products are affected.

TianoCore EDK II maintainerRed Hat EDK II distributorSUSE EDK II distributorIntel Hardware vendor

16-year-old UEFI flaw lets attackers run code before Secure Boot on servers
thehackernews.com

How it unfolded 1 development · click the chart to see its coverage articlesposts

Peak 1 piece in 4h at Oct 27, 4 PM; 4 pieces over 15 days (3 articles · 1 post) Oct 27, 4 PM — 1 piece · 1 article — Google News 1Oct 27, 8 PM — quietOct 28, 12 AM — quietOct 28, 4 AM — quietOct 28, 8 AM — quietOct 28, 12 PM — 1 piece · 1 article — Google News 1Oct 28, 4 PM — quietOct 28, 8 PM — quietOct 29, 12 AM — 1 piece · 1 post — Mastodon 1Oct 29, 4 AM — quietOct 29, 8 AM — quietOct 29, 12 PM — 1 piece · 1 article — Mastodon 1Oct 29, 4 PM — quietOct 29, 8 PM — quietOct 30, 12 AM — quietOct 30, 4 AM — quietOct 30, 8 AM — quietOct 30, 12 PM — quietOct 30, 4 PM — quietOct 30, 8 PM — quietOct 31, 12 AM — quietOct 31, 4 AM — quietOct 31, 8 AM — quietOct 31, 12 PM — quietOct 31, 4 PM — quietOct 31, 8 PM — quietNov 1, 12 AM — quietNov 1, 3 AM — quietNov 1, 7 AM — quietNov 1, 11 AM — quietNov 1, 3 PM — quietNov 1, 7 PM — quietNov 1, 11 PM — quietNov 2, 3 AM — quietNov 2, 7 AM — quietNov 2, 11 AM — quietNov 2, 3 PM — quietNov 2, 7 PM — quietNov 2, 11 PM — quietNov 3, 3 AM — quietNov 3, 7 AM — quietNov 3, 11 AM — quietNov 3, 3 PM — quietNov 3, 7 PM — quietNov 3, 11 PM — quietNov 4, 3 AM — quietNov 4, 7 AM — quietNov 4, 11 AM — quietNov 4, 3 PM — quietNov 4, 7 PM — quietNov 4, 11 PM — quietNov 5, 3 AM — quietNov 5, 7 AM — quietNov 5, 11 AM — quietNov 5, 3 PM — quietNov 5, 7 PM — quietNov 5, 11 PM — quietNov 6, 3 AM — quietNov 6, 7 AM — quietNov 6, 11 AM — quietNov 6, 3 PM — quietNov 6, 7 PM — quietNov 6, 11 PM — quietNov 7, 3 AM — quietNov 7, 7 AM — quietNov 7, 11 AM — quietNov 7, 3 PM — quietNov 7, 7 PM — quietNov 7, 11 PM — quietNov 8, 3 AM — quietNov 8, 7 AM — quietNov 8, 11 AM — quietNov 8, 3 PM — quietNov 8, 7 PM — quietNov 8, 11 PM — quietNov 9, 3 AM — quietNov 9, 7 AM — quietNov 9, 11 AM — quietNov 9, 3 PM — quietNov 9, 7 PM — quietNov 9, 11 PM — quietYesterday, 3 AM — quietYesterday, 7 AM — quietYesterday, 11 AM — quietYesterday, 3 PM — quietYesterday, 7 PM — quietYesterday, 11 PM — quietToday, 3 AM — quietToday, 7 AM — quietToday, 11 AM — quietToday, 3 PM — quietToday, 7 PM — quiet 1
Oct 29Oct 31Nov 2Nov 4Nov 6Nov 8now · 9:14 PM ET
  1. 1

    Vulnerability coverage reaches international audiences

    Security news outlets including BigGo Finance and international platforms amplify reporting on the vulnerability as awareness spreads of the 16-year-old flaw affecting critical server infrastructure.

    “A critical 16-year-old flaw in EDK II, the open-source code that most hardware makers use to build UEFI firmware, can allow an attacker to run code on a machine before its operating system loads, but only while the machine is booting over the network.”
    — The Hacker News · source
    • ottoto2017@prattohome.com

      「16年前から存在する重大なUEFIの脆弱性により、ネットワークブートサーバーでセキュアブート前にコードが実行される可能性 」： # TheHackerNews 「ほとんどのハードウェアメーカーがUEFIファームウェアの構築に使用しているオープンソースコードであるEDK II には、16年前から存在する重大な欠陥 があり、攻撃者はオペレーティングシステムがロードされる前にマシン上でコードを実行できる可能性がある。ただし、これはマシンがネットワーク経由で起動している間に限られる。…

      ottoto2017@prattohome.comMastodon13d agoview on Mastodon ↗
  2. background

    Vulnerability details disclosed: buffer overflow enables pre-boot code execution — Technical analysis reveals the flaw is a buffer overflow in EDK II's PXE driver that copies ICMP error messages into a fixed 504-byte memory area without proper size checks. An attacker sending a message longer than 504 bytes can overflow the buffer and execute arbitrary code before Secure Boot loads, or cause a crash. The attack requires network access during the boot window but no authentication.

  3. background

    TianoCore publishes advisory for CVE-2026-97631 — TianoCore, the project behind EDK II, published a security advisory identifying the buffer overflow vulnerability in the PXE network-boot driver. The flaw is rated 9.5 out of 10 in severity. A code fix exists but no stable release of EDK II contains it yet.

  4. background

    Flawed PXE buffer copy loop introduced into EDK II — A commit added to EDK II in November 2010 introduces the vulnerable copy function that does not properly check message size before copying into a fixed 504-byte buffer. This code remains in EDK II through the latest stable release.

Also covered reported alongside — the timeline has no entry for these yet

  1. 2 outlets 16-Year-Old UEFI Bug Rated 9.5 Lets Attackers Run Code Before Secure Boot, and No Stable Release Fixes It

    first by BigGo Finance, 14d ago · also The Hacker News

    1 more headline