Major UEFI Firmware Vulnerability Threatens Servers

A significant vulnerability in the open-source EDK II firmware has been identified, posing a risk to servers by allowing remote code execution before the operating system initializes. This flaw, cataloged as CVE-2026-97631, is located in the network boot (PXE) driver and has been assigned a high severity CVSS v4 score of 9.5.

Unpatched UEFI Vulnerability Details

The vulnerability resides in the NetworkPkg package of the EDK II firmware, which is widely used by manufacturers to develop UEFI firmware. This issue affects a broad range of devices, including servers, desktops, and laptops that utilize network booting.

Despite an advisory indicating that the flaw remains unpatched, a fix has been merged into the public code repository. However, it is now crucial for vendors to integrate and distribute this fix within their firmware updates, a process that can be time-consuming.

During a PXE boot, the UefiPxeBcDxe driver processes ICMP error messages from the network, copying them into a fixed 504-byte buffer. Improper size checking in this process leads to buffer overflow, allowing an attacker to execute arbitrary code. No user interaction or authentication is required to exploit this vulnerability.

Risks to Servers and Mitigation Strategies

The vulnerability poses a substantial risk to servers, particularly in data centers that rely on PXE for deploying and maintaining large numbers of machines. An attacker can cause a system crash or, with more expertise, execute malicious code with high privileges before Secure Boot validation occurs.

To mitigate these risks, organizations should inquire with their server and firmware vendors about update timelines. In the meantime, limiting PXE boot traffic to isolated networks and blocking unexpected ICMP messages are recommended precautions.

Disabling PXE on unnecessary systems and adhering to CISA and NSA guidelines for Secure Boot can also enhance protection against such vulnerabilities.

Wider Implications of Firmware Security Flaws

This discovery adds to a string of firmware security issues, including PKfail and LogoFAIL, which highlight vulnerabilities in pre-boot operations and trusted signing keys. These flaws reveal the potential for attackers to compromise systems before standard security measures take effect.

In response to these ongoing threats, the maintenance of firmware security remains critical. The latest fix, known as pull request 13302, addresses the current issue by implementing proper boundary checks and clearing buffers before use, thereby preventing the exploitation of stale data.

As cyber threats evolve, particularly with the rise of AI-driven attacks, organizations must ensure their defenses are robust enough to counteract these high-speed threats.