TianoCore disclosed CVE-2026-97631 (rated 9.5) in EDK II, the open-source code most hardware makers build UEFI firmware from. It’s 16 years old.
The bug
It’s a buffer overflow in the PXE network-boot code, triggered by crafted ICMP error and status messages during a network boot. An attacker on the network, with no password, can hang the boot or, with work tailored to the exact firmware build, run code before Secure Boot loads. Red Hat and SUSE rate it adjacent-network, not internet-wide. The catch: a code fix exists, but no stable EDK II release has it yet, and the advisory lists no patched version, so most people have nothing to install.
My take
If your servers PXE boot, that boot VLAN just became important. Turn off network boot where you don’t use it, isolate it where you do, and watch for firmware updates from your vendor. I put a quick checklist in a how-to today.
God Bless, and Needs Garlic!
