Code-execution flaw in UEFI firmware affects most servers on planet Earth

A severe memory-corruption bug, CVE-2026-97631, has surfaced in TianoCore EDK II, the open-source reference code that underpins UEFI firmware from nearly every hardware vendor, including AMI, Insyde, Phoenix, and Microsoft's Project Mu fork. Rated 9.5 out of 10, the flaw lies in the PXE Base Code network-boot driver, where ICMP error messages longer than 504 bytes aren't properly bounded, letting an attacker on the local network overwrite memory and execute code at the CPU's most privileged ring before Secure Boot or TPM protections activate. Researchers Alex Matrosov and Dan Holmes found the issue, but AMI accidentally leaked technical details and a fix via a public GitHub pull request ahead of the planned January disclosure, forcing TianoCore to rush out its own advisory. Exploitation requires network-level access and device-specific tuning, limiting likely abuse to insiders or well-resourced attackers, but since the bug is a basic code defect rather than a Secure Boot key issue, administrators should disable PXE network boot where unneeded and apply vendor firmware updates as soon as they're available.