CVE-2026-97631 Details
Description
EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality, Integrity, and Availability.
A vulnerability in the EDK2 BIOS PXE driver allows for out-of-bounds write, classic buffer overflow, and incorrect buffer size calculations. This vulnerability can be exploited remotely by an unauthenticated network attacker who delivers ICMP error messages to a machine during PXE booting. The exploitation corrupts memory and can lead to arbitrary code execution before the operating system loads, bypassing Secure Boot and other OS security measures. The vulnerability affects the EDK II master branch as of September 14, 2026, and has not yet been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 22, 2026CISA-ADP
Assessed Oct 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-120 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') | [email protected] |
| CWE-131 | Incorrect Calculation of Buffer Size | [email protected] |
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Tianocore EDK II | >= 2026-09-14 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 30, 2026 | CVE Modified | CISA-ADP |
| Oct 28, 2026 | CVE Modified | CVE |
| Oct 28, 2026 | CVE Modified | CVE |
| Oct 22, 2026 | New CVE Received | [email protected] |