A 16-year-old buffer overflow flaw in EDK II UEFI firmware code, tracked as CVE-2026-97631, affects network boot operations in versions up to edk2-stable202608.
Learn about the mechanics of this pre-OS execution vector.
What can happen when booting over a network
When a device boots over the network, it receives status and error messages. An error in the way their size is checked can cause the system to hang and not complete the boot.
To cause the problem, an attacker must be able to communicate with the device over a network at the time it starts. No password or prior access to the device is required.
Executing their own code requires the attacker to tailor the attack to the exact boot software of the device. If successful, the code executes before the operating system and Secure Boot protection are loaded. It does not persist on the device after a reboot on its own.
Which devices are affected?
The issue is in EDK II, an open source software used for device booting. It is used by independent vendors such as AMI, Insyde, and Phoenix, as well as Microsoft's Project Mu. Versions up to and including edk2-stable202608, released on August 21, are affected.
↳
READ ALSO
HACKS.GR / RELATED
Vulnerabilities & Security Updates
Adobe patches serious security vulnerabilities in Adobe Campaign Classic and Adobe Connect
↗
Linux distributions Red Hat, SUSE and Debian report that their respective packages are affected and have not yet been patched. Intel and Arm said they are not aware of any commercial products or product lines being directly affected.
What has happened so far?
The issue was discovered by Alex Matrosov of Anthropic and Dan Holmes-Mitra of Google. It was made public early on September 28, when a code change proposal containing the fix and its description was published. TianoCore published a warning about the issue on October 22.
The fix was added to the core development code on October 15, but has not yet been released in a stable release. So far, there is no evidence that the issue has been used in real attacks. Those who manage devices and do not need network boot can disable it to reduce the risk.
G
HACKS.GR / GOOGLE SEARCH
Hacks.gr on Google
Set Hacks.gr as a preferred source.
Preferred source
↗
end of article
Top comments (0)