Most Servers on the Planet Are Vulnerable to This Firmware Code-Execution Flaw
A newly disclosed flaw in widely used UEFI firmware code could let attackers run code during a device’s boot process, before protections such as Secure Boot take effect. Its reach matters because the vulnerable code is used across hardware and cloud systems, while firmware updates can be slow and difficult to deploy.
Tracked as CVE-2026-97631 and rated 9.5 out of 10, the 16-year-old buffer overflow is in EDK II’s PXE network-boot driver. An attacker with access to a local network could send an oversized ICMP error message, exceeding a 504-byte buffer and corrupting memory. The immediate payload runs only once, but could help install further boot-level malware; the flaw was disclosed ahead of a planned coordinated announcement after a vendor published patch details.
In short
- A 16-year-old flaw affects widely used UEFI boot code.
- Attackers on a local network could exploit oversized ICMP messages.
- Firmware patching across devices may take time.
Steelman: both sides, in good faith
The strongest fair case each way — we don't pick a winner.
The case for
The flaw merits urgent attention because code execution during boot can bypass protections that normally apply later, and the reported network attack path could expose systems before users can rely on those safeguards. Given the code’s broad use and the difficulty of updating firmware, prompt patching and clear disclosure help administrators assess and reduce a potentially serious risk.
The case against
The reported attack requires access to a local network, and the immediate payload runs only once, so the practical danger may depend heavily on each system’s exposure and configuration. Public patch details released ahead of the planned announcement could give attackers useful information before many organisations can update, making careful timing and measured risk communication important.
Explained simply
UEFI firmware is low-level software that starts a computer and prepares it to load an operating system. EDK II is a widely used open-source project for building this firmware, including code that lets devices start up from a network.
The flaw is in that network-boot code, which handles messages sent over a local network. If an attacker can reach a vulnerable device on that network, a specially formed message could make the code run during startup, before some security protections are active.
The code is used in hardware from multiple vendors, including systems in cloud data centres. Fixing firmware often requires updates from device makers and can be harder to deploy than ordinary software updates, so identifying affected systems and installing patches may take time.