GoKawiilCritical EDK II UEFI flaw rated 9.5 severity exposes most server firmware
Researchers from Anthropic and Google found a memory-corruption vulnerability (CVE-2026-97631) in an ICMP component of TianoCore EDK II, the open-source codebase underlying UEFI firmware used by nearly all major hardware vendors including AMI, Insyde and Phoenix. The flaw allows code execution before the OS or protections like Secure Boot load, though the payloads it delivers aren't persistent on their own. A coordinated disclosure planned for January was disrupted after AMI published a pull request with details and a fix, prompting TianoCore to issue a public advisory early.