TianoCore Publishes Advisory for 9.5-Severity UEFI Firmware Flaw

TianoCore Project members published a public advisory last week for a memory-corruption vulnerability in the open source codebase used to build UEFI firmware, after a vendor pull request exposed the flaw ahead of a planned January coordinated disclosure, according to wired.com.

The flaw, tracked as CVE-2026-97631, carries a severity rating of 9.5 out of 10 and affects the TianoCore EDK II codebase. It is a 16-year-old buffer overflow in the PXE-Base Code driver (NetworkPkg/UefiPxeBcDxe), which lets devices boot using code downloaded from a local network.

The driver does not enforce a 504-byte memory copy limit when monitoring ICMP errors during PXE boot, allowing adjacent data to be overwritten. An attacker can use this to trigger a denial-of-service by hanging the boot sequence, or to plant a counterfeit event that executes code in the UEFI firmware environment at CPU ring 0. Such exploits bypass attestation processes used to cryptographically prove hardware is secure to remote servers, though the final payloads have no persistence and run only once.

The vulnerability was discovered by Alex Matrosov of Anthropic and Dan Holmes of Google. The discovering parties had arranged for the flaw to stay under wraps until a coordinated disclosure scheduled for January.

AMI published a pull request last month that detailed the vulnerability and included a code fix. Before that, a representative of the UEFI Forum had called EDK2 the preeminent solution and implementation of the UEFI specifications. The advisory comes six days after another botched disclosure involving a critical code-execution vulnerability in the PHP programming language.