Code-execution flaw in UEFI firmware threatens most servers on planet Earth

A critical flaw in the open-source EDK II code used to build UEFI firmware could let attackers run code during a device’s boot process, before protections such as Secure Boot are active. The vulnerability, rated 9.5 out of 10, may affect firmware from most major vendors and server providers, making it difficult to assess and patch across a large number of devices.

Tracked as CVE-2026-97631, the 16-year-old memory-corruption bug is in a network driver used for booting from a local network. An attacker with access to that network can send a crafted ICMP error message that exceeds a 504-byte buffer and corrupts adjacent data; although the initial payload does not persist, it could help install code that runs during later boots. The flaw was due for coordinated disclosure in January, but a vendor’s public patch request led to an earlier advisory, giving advanced attackers information to develop exploits.