Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers

A buffer overflow discovered in EDK II, the open-source base for most UEFI firmware, has existed since a 2010 commit and lets an attacker trigger code execution during network (PXE) boot, before Secure Boot checks even run. Tracked as CVE-2026-97631 and rated 9.5/10 by TianoCore, the bug stems from a broken size check when the PXE driver copies ICMP and status messages into a fixed 504-byte buffer, affecting both IPv4 and IPv6 paths. Exploitation requires network adjacency during the PXE boot window rather than internet-wide access, and simple triggering causes a crash, while firmware-specific tailoring can achieve arbitrary code execution. A source-level fix merged on October 15 has been adopted by Microsoft's Project Mu, but no stable EDK II release — including edk2-stable202608 — ships it yet, leaving Red Hat, SUSE, and Debian packages unpatched; disabling unused PXE boot is the only mitigation for now.