A critical vulnerability in the boot-time firmware used by most of the world's server vendors and data centers could let attackers execute malicious code before operating system defenses load. Tracked as CVE-2026-97631 and rated 9.5 out of 10 in severity, the flaw is a memory-corruption bug in TianoCore EDK II, the open source codebase behind most UEFI firmware.
Defenders worldwide now face the task of responding to a code-execution vulnerability in boot-time firmware used by most of the world's server vendors and data centers.
The flaw, rated 9.5 out of 10 in severity, sits in TianoCore EDK II, an open source codebase that hardware makers and cloud providers use to create the UEFI firmware that runs during the boot-up sequence. Virtually all UEFI suppliers, including AMI, Insyde and Phoenix, use the reference code extensively. Project Mu, Microsoft's hardened fork of EDK2, also used the code containing the vulnerable component. Last year, a representative of the UEFI Forum called EDK2 the "preeminent solution / implementation of the UEFI specifications."
The vulnerability is a memory-corruption flaw in an ICMP component that attackers can exploit to execute malicious code that runs before the operating system and firmware can implement defenses such as Secure Boot, which establishes a chain of trust for all code loaded during boot, including the Trusted Platform Module.
While final payloads delivered by the vulnerability have no persistence, meaning they run only once, they can give attackers a wide opening to install other payloads that also run each time early in the boot process.
Analysis
Why This Matters
- The flaw sits in firmware that runs before the operating system and security tools load, so it can bypass protections such as Secure Boot and the TPM chain of trust.
- Because virtually every major UEFI supplier builds on EDK II, the vulnerable code reaches most servers in data centers worldwide, putting defenders everywhere on patch duty.
- Even though final payloads run only once, they can open the door to persistent malware that reloads early in every boot.
Background
UEFI is the firmware that starts a computer before the operating system loads, initialising hardware and handing control to the OS. EDK II is the open source reference implementation of the UEFI specifications, and most independent BIOS vendors build their commercial firmware from it, which is why a flaw deep in this codebase can have such wide reach. Secure Boot is the mechanism firmware uses to verify that only trusted code loads during startup.
What to Watch
- Whether UEFI vendors and cloud providers ship patched firmware builds based on a fixed EDK II, and how quickly data center operators can deploy them.
- Early reports of exploitation in the wild targeting the flaw before patches are widespread.
- Clarification of the full scope: which server models and cloud platforms ship the vulnerable ICMP component in their boot firmware.
Checked
11 claims in this story checked against 1 source: 9 supported.
Show each claim
- SupportedThe boot-time firmware flaw threatens most servers worldwide.Ars Technica - All content: “Code-execution flaw in UEFI firmware threatens most servers on planet Earth.”
- Not in the sourcesThe vulnerability is critical.Ars Technica - All content: “The vulnerability, with a severity rating of 9.5 out of 10, resides in the TianoCore EDK II”
- SupportedThe vulnerability is a memory-corruption flaw in TianoCore EDK II.Ars Technica - All content: “The vulnerability, tracked as CVE-2026-97631, is a memory-corruption flaw in an ICMP component”
- SupportedThe flaw is rated 9.5 out of 10 in severity.Ars Technica - All content: “The vulnerability, with a severity rating of 9.5 out of 10, resides in the TianoCore EDK II”
- Partly supportedThe flaw could let attackers execute malicious code before operating-system defenses load.Ars Technica - All content: “attackers can exploit to execute malicious code that runs before the operating system and firmware can implement defenses like Secure Boot”
- SupportedThe vulnerability is tracked as CVE-2026-97631.Ars Technica - All content: “The vulnerability, tracked as CVE-2026-97631, is a memory-corruption flaw”
- SupportedTianoCore EDK II is an open-source codebase used to create UEFI firmware.Ars Technica - All content: “an open source codebase that hardware makers and cloud providers use to create the UEFI firmware that runs during the boot-up sequence.”
- SupportedA UEFI Forum representative called EDK2 the “preeminent solution / implementation of the UEFI specifications” last year.Ars Technica - All content: “Last year, a representative of the UEFI Forum called EDK2 the "preeminent solution / implementation of the UEFI specifications."”
- SupportedVirtually all UEFI suppliers, including AMI, Insyde and Phoenix, use the reference code extensively.Ars Technica - All content: “Virtually all UEFI suppliers (sometimes still called IBVs or independent BIOS vendors), including AMI, Insyde, and Phoenix, use the reference code extensively.”
- SupportedProject Mu, Microsoft’s hardened EDK2 fork, used code containing the vulnerable component.Ars Technica - All content: “Project Mu, Microsoft's hardened EDK2 fork, used the code containing the vulnerable component as well.”
- SupportedThe vulnerability’s final payloads have no persistence and run only once.Ars Technica - All content: “While final payloads delivered by CVE-2026-97631 have no persistence—meaning they run only once—they can give attackers a wide opening”
