Critical UEFI vulnerability endangers massive numbers of servers around the world
A 16-year-old vulnerability in the UEFI firmware could allow attackers to execute their own code with the highest system privileges before the operating system starts.
Almost maximum severity
The now that have become known Vulnerability CVE-2026-97631 has a very high severity score of 9.5 out of 10 and potentially affects numerous servers and data centers around the world. Systems that are started over the network and rely on the open source code EDK II are particularly at risk. The vulnerability is in the PXE base code driver of EDK II, a widely used reference implementation for the UEFI firmware of modern computers. Numerous hardware manufacturers and firmware vendors use the codebase, including companies that develop BIOS and UEFI solutions for servers and other devices. How many systems are actually affected is still unclear.
The vulnerability is due to a flaw in the processing of ICMP error messages during network startup. The responsible driver copies received data into a memory area that is limited to 504 bytes. However, due to an incorrect length check, attackers can inject larger messages and thus overwrite neighboring memory areas. If the attack is successful, the injected code can already be executed in the UEFI environment. This happens before the operating system’s protective mechanisms take effect. Security functions that are actually supposed to secure the starting process are also vulnerable. Researchers Alex Matrosov of Anthropic and Dan Holmes of Google discovered the vulnerability and actually didn’t plan to release information until January.
Attacks not so easy
However, attacks on affected systems are not trivial. This means attackers must have access to the network path of the target system during the PXE boot process. They also have to know the specific firmware configuration and adapt their attack accordingly. Any attack from the Internet is therefore not easily possible. In addition to executing malicious code, manipulated messages can also cause the startup process to hang, meaning that perhaps no takeover is possible, but a significant operational disruption is possible. Information about the vulnerability and a possible fix became public ahead of schedule. This allows attackers to analyze the error and develop their own exploits before all manufacturers have updated their firmware.
The distribution of corresponding updates is likely to be time-consuming anyway given the large number of affected devices. Based on current knowledge, there is no immediate risk for ordinary home computers that only boot from a local hard drive or SSD. Organizations with network-based launch environments, however, should evaluate whether their systems are affected. Administrators should check with their firmware provider for updates and temporarily disable network boot if not needed. Secure Boot and TPM remain important protection measures, but do not reliably prevent this attack. Monitoring system logs can also help detect suspicious activity.
Research Snipers is currently covering all technology news including Google, Apple, Android, Xiaomi, Huawei, Samsung News, and More. Research Snipers has decade of experience in breaking technology news, covering latest trends in tech news, and recent developments. Can be reached at author1@researchsnipers.com
