Flaw in open-source UEFI firmware code lets attackers run code on network-booting servers
Server operators who boot over the network have no patched stable release yet and may need to disable network booting until firmware vendors ship fixes.
A flaw tracked as CVE-2026-97631, rated 9.5 out of 10, sits in EDK II, the open-source reference code behind most UEFI firmware, and affects only machines that boot over the network. An attacker who sends one crafted error message during a network boot can crash the startup process, and with a build-specific exploit can run code before Secure Boot checks begin. The bug has been in the code since 2010, and the newest stable release, edk2-stable202608, still contains it. A fix is in the source tree but not in any stable release, so server operators have to wait for firmware vendors to ship updates or disable network booting in the meantime.
Why it matters
The flaw affects machines that boot over the network, mainly servers and data center equipment, so the people running that hardware are the ones who must act. The bug has sat in the shared EDK II code since a 2010 commit and is present in the newest stable release, so it is not limited to a single vendor's firmware. A fix exists in the source tree, but until stable releases and vendor updates arrive, operators have only the workaround of turning off network booting.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.