UEFI firmware EDK2 has a 9.5-severity code-execution flaw

A memory-corruption bug tracked as CVE-2026-97631 was found in TianoCore EDK II, the open source base for UEFI firmware used by AMI, Insyde, Phoenix and Microsoft's Project Mu. The flaw lets attackers run code before the OS loads, bypassing Secure Boot and TPM protections; a patch is already public after disclosure came earlier than the planned January date.

• CVE-2026-97631 carries a severity rating of 9.5 out of 10
• The bug is a 16-year-old buffer overflow in the UefiPxeBcDxe driver
• ICMP error copies are not capped at the 504-byte field
• Patch code went public ahead of the coordinated January date