Code-execution flaw in boot-time firmware threatens most servers worldwide
Memory-corruption bug in TianoCore EDK II carries a 9.5 severity rating
A critical vulnerability in the boot-time firmware used by most of the world's server vendors and data centers could let attackers execute malicious code before operating system defenses load. Tracked as CVE-2026-97631 and rated 9.5 out of 10 in severity, the flaw is a memory-corruption bug in TianoCore EDK II, the open source codebase behind most UEFI firmware.