CVE-2026-97631
Pre-boot RCE in EDK II PXE driver
CVE-2026-97631 is a critical vulnerability (CVSS 9.5) in Tianocore Edk2, published October 22, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.64%, the 50th percentile. No source names a fixed version.
EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality, Integrity, and Availability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Pre-boot RCE in EDK II PXE driver
EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality, Integrity, and Availability.
- Record
CVE-2026-97631- CVSS 4.0
- 9.5 Critical
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - Weakness
- CWE-120, CWE-131, CWE-787
- Updated
- 2026-11-02
EUVDEUVD-2026-108230
EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality, Integrity, and Availability.
- Record
EUVD-2026-108230- CVSS 4.0
- 9.5 Critical
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - Updated
- 2026-11-02
NVD
EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality, Integrity, and Availability.
- Record
CVE-2026-97631- CVSS 4.0
- 9.5 Critical
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-120, CWE-131, CWE-787
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-97631
EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality, Integrity, and Availability.
- Record
DEBIAN-CVE-2026-97631- CVSS 4.0
- 9.5 Critical
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-97631
EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality, Integrity, and Availability.
- Record
UBUNTU-CVE-2026-97631- CVSS 4.0
- 9.5 Critical
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - Updated
- 2026-11-02
OSVAZL-111944 No score
CVE-2026-97631 affecting package edk2 20240524git3e722403cd16-21
EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality, Integrity, and Availability.
- Record
AZL-111944- Updated
- 2026-11-02
OSVAZL-112172 No score
CVE-2026-97631 affecting package qemu 10.1.0-2
EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality, Integrity, and Availability.
- Record
AZL-112172- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
edk2Azure Linux:3 |
through 20240524git3e722403cd16-21 | None known |
qemuAzure Linux:3 |
through 10.1.0-2 | None known |
edk2Debian:12 |
All versions, plus listed versions 2022.11-62022.11-6+deb12u12022.11-6+deb12u22023.02-12023.02-2 Show 45 moreShow less2023.05-12023.05-22023.08-12023.11-12023.11-22023.11-32023.11-42023.11-52023.11-62023.11-72023.11-82024.02-12024.02-22024.05-12024.05-22024.08-12024.08-22024.08-32024.08-42024.11-12024.11-22024.11-32024.11-42024.11-52025.02-12025.02-102025.02-22025.02-32025.02-42025.02-52025.02-62025.02-72025.02-82025.02-92025.05-12025.05-22025.08.01-12025.08.01-22025.08.01-32025.08.01-42025.08.01-52025.08.01-62025.11-12025.11-22025.11-3 |
None known |
edk2Debian:13 |
All versions, plus listed versions 2025.02-102025.02-82025.02-8+deb13u12025.02-92025.05-1 Show 20 moreShow less2025.05-22025.08.01-12025.08.01-22025.08.01-32025.08.01-42025.08.01-52025.08.01-62025.11-12025.11-22025.11-32025.11-42025.11-52026.02-12026.02-22026.02-32026.05-12026.05-22026.05-32026.08+ds-12026.08+ds-2 |
None known |
edk2Debian:14 |
All versions, plus listed versions 2025.02-102025.02-82025.02-92025.05-12025.05-2 Show 19 moreShow less2025.08.01-12025.08.01-22025.08.01-32025.08.01-42025.08.01-52025.08.01-62025.11-12025.11-22025.11-32025.11-42025.11-52026.02-12026.02-22026.02-32026.05-12026.05-22026.05-32026.08+ds-12026.08+ds-2 |
None known |
edk2Ubuntu:Pro:16.04:LTS |
All versions, plus listed versions 0~20150106.5c2d456b-20~20160104.c2a892d7-10~20160408.ffea0a2c-20~20160408.ffea0a2c-2ubuntu0.10~20160408.ffea0a2c-2ubuntu0.20~20160408.ffea0a2c-2ubuntu0.2+esm10~20160408.ffea0a2c-2ubuntu0.2+esm30~20160408.ffea0a2c-2ubuntu0.2+esm4 |
None known |
edk2Ubuntu:Pro:18.04:LTS |
All versions, plus listed versions 0~20170911.5dfba97c-10~20171010.234dbcef-10~20171027.76fd5a66-10~20171205.a9212288-10~20180105.0bc94c74-1 Show 8 moreShow less0~20180205.c0d9813c-10~20180205.c0d9813c-20~20180205.c0d9813c-2ubuntu0.10~20180205.c0d9813c-2ubuntu0.20~20180205.c0d9813c-2ubuntu0.30~20180205.c0d9813c-2ubuntu0.3+esm10~20180205.c0d9813c-2ubuntu0.3+esm20~20180205.c0d9813c-2ubuntu0.3+esm3 |
None known |
edk2Ubuntu:Pro:20.04:LTS |
All versions, plus listed versions 0~20190606.20d2e5a1-2ubuntu10~20190828.37eef910-30~20190828.37eef910-40~20191122.bd85bf54-10~20191122.bd85bf54-1ubuntu1 Show 11 moreShow less0~20191122.bd85bf54-20~20191122.bd85bf54-2ubuntu10~20191122.bd85bf54-2ubuntu20~20191122.bd85bf54-2ubuntu30~20191122.bd85bf54-2ubuntu3.10~20191122.bd85bf54-2ubuntu3.20~20191122.bd85bf54-2ubuntu3.30~20191122.bd85bf54-2ubuntu3.40~20191122.bd85bf54-2ubuntu3.50~20191122.bd85bf54-2ubuntu3.60~20191122.bd85bf54-2ubuntu3.6+esm1 |
None known |
edk2Ubuntu:22.04:LTS |
All versions, plus listed versions 2021.08~rc0-22021.08-32021.11~rc1-12021.11-12021.11-2 Show 12 moreShow less2022.02~rc1-12022.02~rc1-1ubuntu12022.02-12022.02-22022.02-32022.02-3ubuntu0.22.04.12022.02-3ubuntu0.22.04.22022.02-3ubuntu0.22.04.32022.02-3ubuntu0.22.04.42022.02-3ubuntu0.22.04.52022.02-3ubuntu0.22.04.62022.02-3ubuntu0.22.04.7 |
None known |
edk2Ubuntu:24.04:LTS |
All versions, plus listed versions 2023.05-22023.11-22023.11-32023.11-42023.11-5 Show 13 moreShow less2023.11-62023.11-82024.02-12024.02-22024.02-2ubuntu0.12024.02-2ubuntu0.32024.02-2ubuntu0.42024.02-2ubuntu0.52024.02-2ubuntu0.62024.02-2ubuntu0.72024.02-2ubuntu0.82024.02-2ubuntu0.92024.02-2ubuntu0.10 |
None known |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
edk2Ubuntu:26.10 |
All versions, plus listed versions 2025.11-3ubuntu72025.11-3ubuntu82026.05-2ubuntu12026.05-2ubuntu22026.05-2ubuntu3 |
None known |
edk2-hweUbuntu:26.10 |
All versions, plus listed versions 2025.11-3ubuntu82025.11-3ubuntu92026.05-2ubuntu12026.05-2ubuntu22026.05-2ubuntu3 |
None known |
edk2Ubuntu:26.04:LTS |
All versions, plus listed versions 2025.02-8ubuntu32025.11-3ubuntu62025.11-3ubuntu72025.11-3ubuntu7.22025.11-3ubuntu7.3 |
None known |
edk2-hweUbuntu:26.04:LTS |
All versions, plus listed versions 2025.11-3ubuntu62025.11-3ubuntu82025.11-3ubuntu8.2 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | RayanZiani/Bootjack | 2026-10-29 |
| PoC in GitHub | Try2Take/CVE-2026-97631-PoC | 2026-10-29 |
| PoC in GitHub | slabbdev/uefi-pxe-cve-2026-97631 | 2026-10-28 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-02 | created | CVE List, EUVD, NVD, OSV, PoC in GitHub |
References
github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m
arstechnica.com/security/2026/10/code-execution-flaw-in-uefi-firmware-threatens-most-servers-on-planet-earth
news.ycombinator.com/item?id=50265393
openwall.com/lists/oss-security/2026/10/28/4
Show 11 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-97631
security-tracker.debian.org/tracker/CVE-2026-97631
ubuntu.com/security/CVE-2026-97631
cve.org/CVERecord?id=CVE-2026-97631
bugs.debian.org/cgi-bin/bugreport.cgi?bug=1151853
Left out here: 10 versions. The JSON record has them.