SZB-b3a2b86944
TianoCore EDK II UEFI flaw CVE-2026-97631 reported to allow pre-boot code execution
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- TianoCore
- Product
- EDK II
- First seen
Summary
A dailytechnow.com post shared on Mastodon describes CVE-2026-97631, a critical UEFI firmware flaw in TianoCore EDK II that it says is 16 years old. The post says the flaw allows code execution before the operating system boots.
If you use TianoCore
Check server and firmware vendors for UEFI updates that address CVE-2026-97631.
Apply vendor firmware updates once they are available and verify the fixed version.
Confirm Secure Boot is enabled and restrict physical and out-of-band management access to servers.
Monitor the NVD and vendor advisories for official confirmation and details of the flaw.
What the sources say 1
· Mastodon: “A critical 16-year-old UEFI firmware vulnerability (CVE-2026-97631) in TianoCore EDK II allows pre-boot code execution.” Source