A memory-corruption vulnerability, CVE-2026-97631, rated 9.5 out of 10 in severity, has been found in the TianoCore EDK II codebase that underpins UEFI firmware used by nearly all major hardware vendors including AMI, Insyde, and Phoenix, as well as Microsoft's Project Mu fork. The flaw lies in an ICMP component and lets attackers run malicious code before Secure Boot and other defenses load, though the payload itself does not persist across reboots. A planned coordinated disclosure for January was disrupted when AMI published a pull request detailing the bug and its fix last month, prompting TianoCore to issue a public advisory last week.
wired.com
· 2026-10-28
Researchers from Anthropic and Google found a memory-corruption vulnerability (CVE-2026-97631) in an ICMP component of TianoCore EDK II, the open-source codebase underlying UEFI firmware used by nearly all major hardware vendors including AMI, Insyde and Phoenix. The flaw allows code execution before the OS or protections like Secure Boot load, though the payloads it delivers aren't persistent on their own. A coordinated disclosure planned for January was disrupted after AMI published a pull request with details and a fix, prompting TianoCore to issue a public advisory early.
it.slashdot.org
· 2026-10-27
Researchers Alex Matrosov and Dan Holmes discovered a memory-corruption flaw, rated 9.5 out of 10 in severity, in an ICMP component of TianoCore EDK II, the open-source reference code underlying UEFI firmware used by most hardware vendors including AMI, Insyde, and Phoenix. The flaw allows code execution before the operating system or protections like Secure Boot can engage, and although the initial exploit payload doesn't persist, it could be used to install other malware that runs at every boot. A planned coordinated disclosure for January was disrupted after AMI published a pull request detailing the bug and fix last month, prompting TianoCore to issue a public advisory early.
arstechnica.com
· 2026-10-27
GoKawiil