A firmware bug about 16 years old can run code before Secure Boot. It leaked early.
By Lior AharonovFounder, 7IT Solutions ·
What happened
CVE-2026-97631 is a critical buffer overflow in TianoCore EDK II, the base of firmware from AMI, Insyde and Phoenix. SecurityWeek, citing Ars Technica, says an oversized ICMP error sent during a PXE network boot can hang the machine or, if the firmware build is known, run code before Secure Boot takes effect. It went public months before a planned January disclosure, after AMI published a code fix.
Why it matters
Firmware runs under everything else you secure, so your OS patching never touches it. The report says the attacker needs a spot on your local network while the machine boots over the network.
What to do
If your servers boot over PXE, ask your firmware vendor for the fixed build now. The fix reaches you through the vendor, not through an OS update.
My take
Lior Aharonov
Founder, 7IT Solutions
Your patch cycle starts at the operating system. This bug starts below it.
Sources
| SecurityWeek: In Other News roundup | securityweek.com |
Researched with AI tools; every fact is checked against the linked sources.