CVE-2026-97631 PUBLISHED

Pre-boot RCE in EDK II PXE driver

Assigner: TianoCore
Reserved: 24.09.2026 Published: 22.10.2026 Updated: 22.10.2026

EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality, Integrity, and Availability.

Metrics

CVSS 4.0

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVSS Score: 9.5

Exploitability Metrics		Vulnerable System Impact Metrics		Subsequent System Impact Metrics
Attack Vector	Network	Confidentiality	High	Confidentiality	High
Attack Complexity	Low	Integrity	High	Integrity	High
Attack Requirements	Present	Availability	High	Availability	High
Privileges Required	None
User Interaction	None

CVSS 4.0

Product Status

Vendor	TianoCore
Product	EDK2
Versions	Default: unaffected affected from 0 to edk2-stable202608 (incl.)

Credits

Alex Matrosov (Anthropic) finder
Dan Holmes-Mitra (Google) finder

References

https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m

Problem Types

CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') CWE
CWE-131 Incorrect calculation of buffer size CWE
CWE-787 Out-of-bounds write CWE