A critical buffer-overflow flaw tracked as CVE-2026-97631 resides in the open-source TianoCore EDK II used to build UEFI firmware. The vulnerability allows an unauthenticated attacker to send malformed ICMP error messages during PXE-boot over IPv4 or IPv6, corrupting DXE-phase memory and executing arbitrary code before Secure Boot or measured boot can verify any OS component. TianoCore rated the bug 9.5 out of 10 and merged a fix into the EDK II source on GitHub on Oct. 15, but the advisory still states the issue is “Not patched currently” because no new package version has been released. Debian’s Bookworm, Trixie, Forky and Sid releases include vulnerable EDK II packages, and the vendor added boundary checks that truncate oversized packets when the buffer is full. 1
Published by Bank Info Security · On GETSECURE.ai ·
Critical UEFI Flaw Exposes Systems to Pre-Boot Attacks
⚡ High Priority
Why This Matters
If you use devices that rely on TianoCore’s EDK II firmware—especially Debian-based systems—you should verify whether a patched version is available and monitor vendor advisories for an updated release.
Title card · GETSECURE.ai
References
- Bank Info Security. (2026, October 30). Critical UEFI Flaw Exposes Systems to Pre-Boot Attacks. Bank Info Security. https://www.bankinfosecurity.com/critical-uefi-flaw-exposes-systems-to-pre-boot-attacks-a-33252
Original Source
Bank Info Security
Read original →