TianoCore says a flaw in EDK II's network-startup code can expose systems running a specific development build to pre-OS code execution, with exploitation tied to PXE boot over IPv4 or IPv6.
The vulnerability, CVE-2026-97631, received a 9.5 out of 10 under CVSS 4.0. TianoCore identifies EDK II master as of Sept. 14, 2026, as affected.
The advisory traces the defect to incorrect bounds checks and buffer-offset calculations in the ICMP error handlers. That faulty processing can copy oversized messages beyond a 504-byte field.
An attacker must deliver a unicast ICMP error message to the client's IP while the machine is PXE booting. TianoCore says code execution also requires knowledge of the target firmware build.
EDK II's pull request records the fix's merge into upstream master on Oct. 15. TianoCore said a patched version was not available when its advisory was published.
