GoKawiilCritical UEFI firmware bug CVE-2026-97631 found in widely used TianoCore EDK II code
Researchers Alex Matrosov and Dan Holmes discovered a memory-corruption flaw, rated 9.5 out of 10 in severity, in an ICMP component of TianoCore EDK II, the open-source reference code underlying UEFI firmware used by most hardware vendors including AMI, Insyde, and Phoenix. The flaw allows code execution before the operating system or protections like Secure Boot can engage, and although the initial exploit payload doesn't persist, it could be used to install other malware that runs at every boot. A planned coordinated disclosure for January was disrupted after AMI published a pull request detailing the bug and fix last month, prompting TianoCore to issue a public advisory early.
GoKawiil's interpretation of the reporting above, not reported fact.
Because EDK II underpins firmware across nearly the entire server and PC supply chain, the flaw's reach is unusually broad, and the premature disclosure of patch details could let attackers reverse-engineer exploits before many vendors have shipped fixes. Firmware-level compromises are especially dangerous because they can undermine trust mechanisms like Secure Boot and TPM-based attestation, potentially giving attackers a foothold that's hard to detect or remove. The incident also highlights recurring problems in coordinated vulnerability disclosure, where premature code publication can leave defenders racing against exposed exploit details.
- A 9.5-severity memory-corruption bug (CVE-2026-97631) was found in TianoCore EDK II, the base code for most UEFI firmware.
- The flaw lets attackers execute code before OS-level defenses like Secure Boot activate, though the initial payload doesn't persist.
- Premature publication of a patch by AMI forced an early public advisory, ahead of the planned January coordinated disclosure.
Source: arstechnica.com, 2026-10-27
Published there as: “Code-execution flaw in UEFI firmware threatens most servers on planet Earth”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.