CVE-2026-97631 buffer overflow in EDK2 PXE Base Code driver

TianoCore published the advisory after AMI merged a public pull request that exposed the ICMP error handling flaw. The defect allows an attacker on the local network to overwrite the fixed 504-byte receive buffer and corrupt the IUEFI module before Secure Boot or TPM measurements occur. Discovery credits go to Alex Matrosov and Dan Holmes; coordinated disclosure collapsed when the fix became visible.

EDK2 serves as the reference implementation for AMI, Insyde, Phoenix, and Microsoft Project Mu firmware. Virtually every server vendor and major cloud provider ships derivatives of this codebase. The vulnerability therefore reaches the installed base of data-center hardware that performs network boots, exactly the population that cannot apply firmware updates at scale.

Patching requires each independent BIOS vendor to integrate the change, obtain platform-specific validation, and push signed capsules through OEM and cloud supply chains. Historical UEFI updates show multi-year lag times even for critical issues. No CVE record or incident report yet documents in-the-wild exploitation.

Operational impact is limited to devices that enable PXE boot and lack compensating network controls. Organizations should disable PXE where unused and monitor for unsigned firmware updates from their hardware vendors.