CVE Tools
Track your stack

CVE-2026-97631

Pre-boot RCE in EDK II PXE driver

No known exploitation. EPSS puts it in the 50th percentile. No fix published yet.

CVSS —Not scoredEPSS percentile50th0.6% chance in 30 daysCISA KEVNot listedNo confirmed exploitation
No public exploit knownFixNone yetNo fix or workaround published

Published Updated Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

  • TianoCore EDK2Affected: ≤ edk2-stable202608Upgrade to: after edk2-stable202608Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record
  1. Ask your IT provider or device manufacturer whether your servers, workstations, or embedded devices use EDK II (UEFI) firmware with PXE network boot enabled.
  2. If network boot (PXE) is not used in your environment, disable it in firmware settings as a precaution.
  3. Check with your hardware vendor (not a software update channel) for a firmware update addressing this issue, since no fix is currently available.
  4. If PXE boot is required, restrict it to trusted, isolated network segments only.
  5. Revisit this item once your vendor publishes a firmware patch and apply it during a planned maintenance window.
May need vendor or contractor work

What it is

From the CVE record

EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality, Integrity, and Availability.

In plain language

Written by AI from the record

This is a flaw in low-level computer startup firmware (used when a machine boots over a network) that could let an attacker take over a device before its operating system even starts, but there's no evidence anyone is exploiting it and most small businesses won't be directly affected.

Remote out-of-bounds write / classic buffer overflow / incorrect buffer-size calculation in the EDK II PXE (network boot) driver can allow pre-boot arbitrary code execution for devices that perform PXE network booting, with no public PoC or exploitation observed and no fix yet published.

If you're affected

  • Full device takeover pre-OS
  • Operational disruption during boot
  • Persistent firmware-level compromise
  • Hard-to-detect malware foothold

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS50th
CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.6% chance of exploitation activity in the next 30 days, which ranks it in the 50th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Attention now

Sustained, driven by wide press coverage.

Lifecycle

8 events over 8 days, from the signal feeds we watch.

  1. Record updated
  2. Record updatedrecord updated
  3. Publishedweakness classified, att&ck mapped, record updated, record updated

Affected products

Technical detail

Weaknesses

ATT&CK techniques

Mapped from the weaknesses above (CWE to ATT&CK), not observed in attacks.

Sources

References in the record

And 3 more references. See all after sign-in

In the news

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for EDK2, not every advisory.