Critical UEFI Firmware Flaw Exposes Most of the World’s Servers to Code Execution Before Boot

A critical vulnerability in widely used server firmware has been publicly disclosed ahead of schedule, leaving the majority of the world’s servers and data centers exposed to potential code-execution attacks. The flaw, tracked as CVE-2026-97631, carries a severity rating of 9.5 out of 10 and was disclosed publicly in October 2026 after a premature leak forced researchers to move up their timeline.

The vulnerability resides in TianoCore EDK II, an open source codebase used by virtually all major UEFI firmware suppliers — including AMI, Insyde, and Phoenix — as well as Microsoft’s hardened EDK2 fork, Project Mu. Because EDK II serves as the foundation for firmware across thousands of hardware makers and cloud providers, the attack surface is exceptionally broad.

Technically, the flaw is a 16-year-old buffer overflow in the PXE-Base Code driver, which allows servers and storage devices to boot from a local network. The driver fails to enforce a 504-byte memory copy limit when monitoring for ICMP error messages, allowing an attacker with low-level local network access to send a malicious error message that corrupts the UEFI module running on the CPU. Critically, this occurs before the operating system can activate defenses such as Secure Boot or the Trusted Platform Module.

The vulnerability was discovered by Alex Matrosov of Anthropic and Dan Holmes of Google, who had arranged a coordinated disclosure scheduled for January. The timeline collapsed after AMI published a pull request last month that detailed the flaw and included a code fix. Once that post surfaced, TianoCore Project members issued a public advisory last week.

Security researcher HD Moore, creator of Metasploit and chief research officer at Dragos, warned that an attacker could exploit the bug to access sensitive components like a device’s TPM during boot — potentially breaking disk encryption with short-term network access or in a theft scenario.

With patch code now publicly available, security experts warn it will be straightforward for sophisticated attackers to build working exploits. Compounding the risk, patching UEFI firmware across millions of end devices is a slow and complex process, leaving systems exposed for an extended period.