Back
CVE-2026-97631
Pre-boot RCE in EDK II PXE driver
Critical9.5EPSS 0.64%
- Published
- Updated
- Reserved
- Assigned by
- TianoCore
Description
EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality, Integrity, and Availability.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| TianoCoreCNA (assigner) | 4.0 | Critical9.5 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
| NVDNVD · Deferred | 4.0 | Critical9.5 | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
- EPSS (exploitation in 30 days)
- 0.64% · top 49% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: no · Technical impact: total
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.5.
Weakness
- CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (opens in a new tab)All about CWE-120 and its CVEs
- CWE-131 Incorrect calculation of buffer size (opens in a new tab)All about CWE-131 and its CVEs
- CWE-787 Out-of-bounds write (opens in a new tab)All about CWE-787 and its CVEs
Affected products
References (6)
- https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m (opens in a new tab)
- https://arstechnica.com/security/2026/10/code-execution-flaw-in-uefi-firmware-threatens-most-servers-on-planet-earth/ (opens in a new tab)
- https://news.ycombinator.com/item?id=50265393 (opens in a new tab)
- https://github.com/microsoft/mu_basecore/pull/1990 (opens in a new tab)
- https://github.com/microsoft/mu_basecore/pull/1989 (opens in a new tab)
- http://www.openwall.com/lists/oss-security/2026/10/28/4 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-97631)Record last updated .