EDK II PXE pre-boot RCE: restrict network boot now

EDK II PXE pre-boot RCE: restrict network boot now

Home » Alert » EDK II PXE pre-boot RCE: restrict network boot now

ALERT · Not known to be exploited. Last updated 29 October 2026. See the Alert Tracker

If your estate still PXE-boots servers or PCs across a shared network, treat CVE-2026-97631 as a network-hygiene job today. The flaw is Critical (CVSS 9.5) in TianoCore EDK II’s PXE driver. It is not known to be exploited. A code fix exists, but TianoCore lists the issue as not patched in a stable release yet — so OEM firmware updates are the eventual fix, and trusted PXE segments are the control you can apply now.

What it is

Pulp illustration of a warning robot inspecting a glowing network boot cable before a motherboard landscape

TianoCore advisory GHSA-99cj-7hg9-mp4m (opens in a new tab) (CVE-2026-97631, published 22 October 2026) covers a pre-boot remote code execution flaw in the EDK II PXE Base Code driver (NetworkPkg/UefiPxeBcDxe). While a machine is PXE-booting over IPv4 or IPv6, an unauthenticated network attacker who can deliver ICMP error messages to it can corrupt DXE-phase memory and run code before the operating system loads, and before Secure Boot or measured boot has verified any OS component. Severity is Critical with a CVSS 4.0 overall score of 9.5.

Who is affected

Pulp illustration of many chassis shapes around a shared glowing blue boot-cable hub

Any platform whose firmware is built from EDK II with the vulnerable PXE driver and that still performs network boot. EDK II underpins a large share of PC and server UEFI firmware; exact OEM SKU exposure depends on each vendor’s tree. The advisory marks EDK II master (as of 14 September 2026) affected and lists patched versions as “Not patched currently.”

Exploitation status

Pulp illustration of a warning robot standing calm beside a sealed vault while a distant cable glows

No public evidence of in-the-wild exploitation as of 29 October 2026. The CVE is not in CISA KEV. FIRST EPSS on 28 October was about 0.005. The exposure window is the duration of a PXE boot, and the attacker must deliver a unicast ICMP error to the client’s address.

Fix and mitigation

Pulp illustration of a warning robot closing a network switch port while a trusted LAN segment glows behind a brass fence

TianoCore points to fix pull request #13302 (opens in a new tab); the advisory still says “Not patched currently” for a stable EDK II release. Until OEM firmware that includes the fix ships:

  • Disable PXE / network boot where you do not need it.
  • Where you do need it, put PXE clients and servers on a dedicated, trusted network segment that untrusted hosts cannot reach with spoofed ICMP.
  • Watch OEM BIOS/UEFI bulletins for builds that cite CVE-2026-97631 or GHSA-99cj-7hg9-mp4m.

Sources

Pulp illustration of a warning robot filing brass document cylinders into a vault drawer

Follow Cyber-Threat.net RSSFeedly (opens in a new tab)X (opens in a new tab)Bluesky (opens in a new tab)LinkedIn (opens in a new tab)