16-year-old UEFI PXE buffer overflow in TianoCore EDK II affects most server firmware

A critical buffer overflow vulnerability tracked as CVE-2026-97631 has been disclosed in TianoCore EDK II, the open-source UEFI firmware codebase that underpins firmware from AMI, Insyde, Phoenix, and Microsoft's Project Mu. The 16-year-old bug resides in the PXE network boot driver's handling of ICMP error messages, where incoming data is copied into a fixed 504-byte buffer without length validation. An attacker with network access to a machine during PXE boot can overwrite adjacent memory and execute arbitrary code at the highest privilege level before any operating system or Secure Boot protections are active.

The disclosure was forced prematurely when AMI published a pull request containing the fix last month, breaking an embargo scheduled for January. The vulnerability is largely irrelevant for systems that boot only from local disks, including most home and small office machines, but poses significant risk to data centers and labs that rely on network booting for fleet management. HD Moore noted the flaw could enable disk encryption bypass with only short-term network access, and predicted it would persist as a 'forever bug' in out-of-support systems. This follows the 2024 PixieFail vulnerabilities in the same EDK II network codebase, suggesting ongoing gaps in firmware security testing despite subsequent fuzzing efforts.

EDK II PXE vulnerability and pre-boot attack surface

• TianoCore EDK II codebase: The bug affects the open-source reference implementation that nearly all commercial firmware vendors build upon, including AMI, Insyde, Phoenix, and Microsoft's Project Mu fork, ensuring broad hardware exposure.
• PXE ICMP buffer overflow: The vulnerability is a classic buffer overflow in the Preboot eXecution Environment driver, specifically in how ICMP error messages are stored in a fixed 504-byte buffer without proper bounds checking on the copied length.
• Pre-boot execution context: Successful exploitation yields code execution in UEFI firmware before the operating system loads, bypassing all OS-level defenses including Secure Boot, TPM measurements, and disk encryption protections that rely on a trusted boot chain.
• Network attack vector: The exploit requires the attacker to send a crafted packet during PXE network boot, making data centers and lab environments with network-booted machine fleets the primary risk population rather than local-disk-booting consumer systems.
• Disclosure timeline failure: The coordinated disclosure embargo, intended to run until January, collapsed when AMI published a fix in a public pull request, forcing TianoCore to issue an advisory before downstream vendors and administrators were fully prepared.

Why it matters

For Linux server deployments and cloud infrastructure relying on PXE boot for provisioning and maintenance, this vulnerability represents a fundamental compromise of the trusted computing base that cannot be mitigated by OS-level patches alone. The repeated discovery of critical flaws in EDK II network code following PixieFail raises serious questions about the adequacy of current open-source firmware security testing practices, and the broken embargo illustrates how vendor missteps in the open-source firmware supply chain directly degrade security outcomes for downstream Linux distributions and their users.