GoKawiilCritical EDK II Firmware Flaw Exposes Most Servers to Boot-Time Code Execution
A memory-corruption vulnerability, CVE-2026-97631, rated 9.5 out of 10 in severity, has been found in the TianoCore EDK II codebase that underpins UEFI firmware used by nearly all major hardware vendors including AMI, Insyde, and Phoenix, as well as Microsoft's Project Mu fork. The flaw lies in an ICMP component and lets attackers run malicious code before Secure Boot and other defenses load, though the payload itself does not persist across reboots. A planned coordinated disclosure for January was disrupted when AMI published a pull request detailing the bug and its fix last month, prompting TianoCore to issue a public advisory last week.