CVE-2026-97631
Pre-boot RCE in EDK II PXE driver
- Published
- Last modified
- Status
- published
- Known exploitation
- Not listed in CISA KEV
- Public exploit
- None on Exploit-DB
Summary
The EDK II firmware development toolkit, specifically its PXE network boot driver used in system BIOS/UEFI firmware, is affected. A remote attacker could exploit memory handling flaws during pre-boot to run arbitrary code, potentially compromising confidentiality, integrity, and availability of the system.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality, Integrity, and Availability.
Affected versions
- NetworkPkg
through edk2-stable202608