thehackernews.com
Oct 29, 2026
Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers
AI-summarised brief · reviewed before publication
A 16‑year‑old buffer‑overflow flaw in EDK II’s PXE network‑boot code allows attackers to send a crafted ICMP message during a network boot, causing memory corruption before Secure Boot activates. The vulnerability, rated 9.5/10 (CVE‑2026‑97631), can halt the boot or, with firmware‑specific payloads, execute code once per boot. Red Hat, SUSE, and other vendors ship the vulnerable code, but no stable EDK II release contains the fix yet. The flaw affects only network‑booting servers, not local‑disk users.
💡 Why It Matters
- · The flaw exposes a critical early‑boot entry point that bypasses all downstream security checks, enabling attackers to implant persistent malware on data‑center hardware without credentials.
- · This vulnerability underscores the need for rapid firmware patching in enterprise environments.
