Defenders worldwide face the task of responding to another severe code-execution vulnerability, affecting boot-time firmware utilized by most server vendors and data centers globally.
Widespread UEFI Firmware Vulnerability
The security flaw carries a severity rating of 9.5 out of 10 and exists within TianoCore EDK II. This open-source codebase serves hardware manufacturers and cloud providers in building the UEFI firmware that operates during system startup. Last year, a UEFI Forum representative described EDK2 as the leading implementation of UEFI specifications. Practically all UEFI suppliers—also known as independent BIOS vendors or IBVs—including AMI, Insyde, and Phoenix, rely heavily on this reference code. Furthermore, Microsoft’s hardened EDK2 fork, Project Mu, also incorporated the component containing the vulnerability.
Designated as CVE-2026-97631, the issue is a memory-corruption flaw found within an Internet Control Message Protocol component. Attackers can exploit this weakness to run malicious code before the operating system and firmware establish protective measures like Secure Boot. Secure Boot creates a chain of trust for all code loaded during startup, including the Trusted Platform Module. Although final payloads deployed via CVE-2026-97631 lack persistence and execute only once, they provide attackers with a significant opportunity to install secondary payloads that run early during every boot cycle.
Disclosure and Patch Challenges
Alex Matrosov from Anthropic and Dan Holmes from Google discovered CVE-2026-97631 and coordinated to keep the details confidential until a planned disclosure in January. However, hardware manufacturer AMI published a pull request last month outlining the vulnerability along with a code fix. After discovering parties noticed the post, members of the TianoCore Project released a public advisory.
With patch code now available publicly, sophisticated hackers can easily understand how to trigger the vulnerability and develop functional exploits. The urgency is further heightened because updating UEFI code across millions of end devices distributed by thousands of hardware makers and cloud providers remains a difficult and lengthy process. The revelation of this security flaw arrives less than a week after a separate disclosure involving a critical code-execution vulnerability in the PHP programming language.
