{"id":"CVE-2026-97631","aliases":["ALSA-2026:96240","AZL-111944","AZL-112172","DEBIAN-CVE-2026-97631","EUVD-2026-108230","RLSA-2026:96240","UBUNTU-CVE-2026-97631"],"status":"published","title":"Pre-boot RCE in EDK II PXE driver","description":"EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds\nWrite”, Classic\nBuffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability\ncan lead to arbitrary\ncode execution. It could also impact\nConfidentiality,\nIntegrity,\nand Availability.","severity":{"version":"4.0","score":9.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00635,"percentile":0.50909,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-120","CWE-131","CWE-787"],"published":"2026-10-22T16:32:27Z","modified":"2026-11-10T22:15:02Z","exploits":[{"source":"pocgithub","id":"slabbdev/uefi-pxe-cve-2026-97631","title":"slabbdev/uefi-pxe-cve-2026-97631","date":"2026-10-28","url":"https://github.com/slabbdev/uefi-pxe-cve-2026-97631"},{"source":"pocgithub","id":"RayanZiani/Bootjack","title":"RayanZiani/Bootjack","date":"2026-10-29","url":"https://github.com/RayanZiani/Bootjack"},{"source":"pocgithub","id":"Try2Take/CVE-2026-97631-PoC","title":"Try2Take/CVE-2026-97631-PoC","date":"2026-10-29","url":"https://github.com/Try2Take/CVE-2026-97631-PoC"}],"fixes":[{"ecosystem":"AlmaLinux:10","package":"edk2-aarch64","fixed_in":["20251114-5.el10_2.3.alma.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"edk2-ovmf","fixed_in":["20251114-5.el10_2.3.alma.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"edk2-tools","fixed_in":["20251114-5.el10_2.3.alma.1"],"sources":["osv"]},{"ecosystem":"AlmaLinux:10","package":"edk2-tools-doc","fixed_in":["20251114-5.el10_2.3.alma.1"],"sources":["osv"]},{"ecosystem":"Rocky Linux:10","package":"edk2","fixed_in":["0:20251114-5.el10_2.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:10","package":"edk2-aarch64","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20251114-5.el10_2.3.alma.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"edk2-ovmf","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20251114-5.el10_2.3.alma.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"edk2-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20251114-5.el10_2.3.alma.1"}]}]},{"source":"osv","ecosystem":"AlmaLinux:10","package":"edk2-tools-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20251114-5.el10_2.3.alma.1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"20240524git3e722403cd16-21"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"10.1.0-2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2022.11-6","2022.11-6+deb12u1","2022.11-6+deb12u2","2023.02-1","2023.02-2","2023.05-1","2023.05-2","2023.08-1","2023.11-1","2023.11-2","2023.11-3","2023.11-4","2023.11-5","2023.11-6","2023.11-7","2023.11-8","2024.02-1","2024.02-2","2024.05-1","2024.05-2","2024.08-1","2024.08-2","2024.08-3","2024.08-4","2024.11-1","2024.11-2","2024.11-3","2024.11-4","2024.11-5","2025.02-1","2025.02-10","2025.02-2","2025.02-3","2025.02-4","2025.02-5","2025.02-6","2025.02-7","2025.02-8","2025.02-9","2025.05-1","2025.05-2","2025.08.01-1","2025.08.01-2","2025.08.01-3","2025.08.01-4","2025.08.01-5","2025.08.01-6","2025.11-1","2025.11-2","2025.11-3","2025.11-4","2025.11-5","2026.02-1","2026.02-2","2026.02-3","2026.05-1","2026.05-2","2026.05-3","2026.08+ds-1","2026.08+ds-2"]},{"source":"osv","ecosystem":"Debian:13","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.02-10","2025.02-8","2025.02-8+deb13u1","2025.02-9","2025.05-1","2025.05-2","2025.08.01-1","2025.08.01-2","2025.08.01-3","2025.08.01-4","2025.08.01-5","2025.08.01-6","2025.11-1","2025.11-2","2025.11-3","2025.11-4","2025.11-5","2026.02-1","2026.02-2","2026.02-3","2026.05-1","2026.05-2","2026.05-3","2026.08+ds-1","2026.08+ds-2"]},{"source":"osv","ecosystem":"Debian:14","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.02-10","2025.02-8","2025.02-9","2025.05-1","2025.05-2","2025.08.01-1","2025.08.01-2","2025.08.01-3","2025.08.01-4","2025.08.01-5","2025.08.01-6","2025.11-1","2025.11-2","2025.11-3","2025.11-4","2025.11-5","2026.02-1","2026.02-2","2026.02-3","2026.05-1","2026.05-2","2026.05-3","2026.08+ds-1","2026.08+ds-2"]},{"source":"osv","ecosystem":"Rocky Linux:10","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:20251114-5.el10_2.3"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0~20150106.5c2d456b-2","0~20160104.c2a892d7-1","0~20160408.ffea0a2c-2","0~20160408.ffea0a2c-2ubuntu0.1","0~20160408.ffea0a2c-2ubuntu0.2","0~20160408.ffea0a2c-2ubuntu0.2+esm1","0~20160408.ffea0a2c-2ubuntu0.2+esm3","0~20160408.ffea0a2c-2ubuntu0.2+esm4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0~20170911.5dfba97c-1","0~20171010.234dbcef-1","0~20171027.76fd5a66-1","0~20171205.a9212288-1","0~20180105.0bc94c74-1","0~20180205.c0d9813c-1","0~20180205.c0d9813c-2","0~20180205.c0d9813c-2ubuntu0.1","0~20180205.c0d9813c-2ubuntu0.2","0~20180205.c0d9813c-2ubuntu0.3","0~20180205.c0d9813c-2ubuntu0.3+esm1","0~20180205.c0d9813c-2ubuntu0.3+esm2","0~20180205.c0d9813c-2ubuntu0.3+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0~20190606.20d2e5a1-2ubuntu1","0~20190828.37eef910-3","0~20190828.37eef910-4","0~20191122.bd85bf54-1","0~20191122.bd85bf54-1ubuntu1","0~20191122.bd85bf54-2","0~20191122.bd85bf54-2ubuntu1","0~20191122.bd85bf54-2ubuntu2","0~20191122.bd85bf54-2ubuntu3","0~20191122.bd85bf54-2ubuntu3.1","0~20191122.bd85bf54-2ubuntu3.2","0~20191122.bd85bf54-2ubuntu3.3","0~20191122.bd85bf54-2ubuntu3.4","0~20191122.bd85bf54-2ubuntu3.5","0~20191122.bd85bf54-2ubuntu3.6","0~20191122.bd85bf54-2ubuntu3.6+esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2021.08~rc0-2","2021.08-3","2021.11~rc1-1","2021.11-1","2021.11-2","2022.02~rc1-1","2022.02~rc1-1ubuntu1","2022.02-1","2022.02-2","2022.02-3","2022.02-3ubuntu0.22.04.1","2022.02-3ubuntu0.22.04.2","2022.02-3ubuntu0.22.04.3","2022.02-3ubuntu0.22.04.4","2022.02-3ubuntu0.22.04.5","2022.02-3ubuntu0.22.04.6","2022.02-3ubuntu0.22.04.7"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2023.05-2","2023.11-2","2023.11-3","2023.11-4","2023.11-5","2023.11-6","2023.11-8","2024.02-1","2024.02-2","2024.02-2ubuntu0.1","2024.02-2ubuntu0.3","2024.02-2ubuntu0.4","2024.02-2ubuntu0.5","2024.02-2ubuntu0.6","2024.02-2ubuntu0.7","2024.02-2ubuntu0.8","2024.02-2ubuntu0.9","2024.02-2ubuntu0.10"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.11-3ubuntu7","2025.11-3ubuntu8","2026.05-2ubuntu1","2026.05-2ubuntu2","2026.05-2ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"edk2-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.11-3ubuntu8","2025.11-3ubuntu9","2026.05-2ubuntu1","2026.05-2ubuntu2","2026.05-2ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"edk2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.02-8ubuntu3","2025.11-3ubuntu6","2025.11-3ubuntu7","2025.11-3ubuntu7.2","2025.11-3ubuntu7.3"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"edk2-hwe","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2025.11-3ubuntu6","2025.11-3ubuntu8","2025.11-3ubuntu8.2"]}],"products":[{"vendor":"tianocore","product":"edk2"}],"references":[{"url":"https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m"},{"url":"https://arstechnica.com/security/2026/10/code-execution-flaw-in-uefi-firmware-threatens-most-servers-on-planet-earth/"},{"url":"https://news.ycombinator.com/item?id=50265393"},{"url":"https://github.com/microsoft/mu_basecore/pull/1990"},{"url":"https://github.com/microsoft/mu_basecore/pull/1989"},{"url":"http://www.openwall.com/lists/oss-security/2026/10/28/4"},{"url":"https://access.redhat.com/errata/RHSA-2026:96240","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-97631","tags":["report"]},{"url":"https://bugzilla.redhat.com/2559129","tags":["report"]},{"url":"https://errata.almalinux.org/10/ALSA-2026-96240.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97631","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-97631","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2026:96240","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2559129","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2026-97631","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-97631","tags":["report"]},{"url":"https://github.com/tianocore/edk2/commit/14cdbb86a1a4f9bcce0d6cb78b04af58f226cf48","tags":["report"]},{"url":"https://github.com/tianocore/edk2/commit/560ed9b5b146ed622d7eb7c40254a9099bd65b84","tags":["report"]},{"url":"https://github.com/tianocore/edk2/commit/fa789071ff0b29f1e568bfe153ef7f3d76bd60e4","tags":["report"]},{"url":"https://github.com/tianocore/edk2/pull/13302","tags":["report"]},{"url":"https://github.com/tianocore/edk2/security/advisories/ghsa-99cj-7hg9-mp4m","tags":["report"]},{"url":"https://security-tracker.debian.org/tracker/cve-2026-97631","tags":["report"]},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1151853","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-97631","title":"Pre-boot RCE in EDK II PXE driver","description":"EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds\nWrite”, Classic\nBuffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability\ncan lead to arbitrary\ncode execution. It could also impact\nConfidentiality,\nIntegrity,\nand Availability.","status":"published","published":"2026-10-22T16:32:27.619Z","modified":"2026-10-30T19:34:40.851Z","cvss":[{"version":"4.0","score":9.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical","assessor":"cna"}],"cwes":["CWE-120","CWE-131","CWE-787"],"updated_at":"2026-11-02T13:44:18.366073Z"}],"euvd":[{"id":"EUVD-2026-108230","description":"EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds\nWrite”, Classic\nBuffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability\ncan lead to arbitrary\ncode execution. It could also impact\nConfidentiality,\nIntegrity,\nand Availability.","status":"published","published":"2026-10-22T16:32:27Z","modified":"2026-10-30T19:34:40Z","cvss":[{"version":"4.0","score":9.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"updated_at":"2026-11-02T16:59:02.288036Z"}],"nvd":[{"id":"CVE-2026-97631","description":"EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds\nWrite”, Classic\nBuffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability\ncan lead to arbitrary\ncode execution. It could also impact\nConfidentiality,\nIntegrity,\nand Availability.","status":"published","published":"2026-10-22T17:17:02.027Z","modified":"2026-10-30T20:17:39.517Z","cvss":[{"version":"4.0","score":9.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical","assessor":"secondary"}],"cwes":["CWE-120","CWE-131","CWE-787"],"updated_at":"2026-11-02T14:13:02.724605Z"}],"osv":[{"id":"DEBIAN-CVE-2026-97631","description":"EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality, Integrity, and Availability.","status":"published","published":"2026-10-22T17:17:02.027Z","modified":"2026-10-31T09:47:25.209216235Z","cvss":[{"version":"4.0","score":9.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"critical"}],"updated_at":"2026-11-02T15:46:07.756422Z"},{"id":"RLSA-2026:96240","title":"Critical: edk2 security update","description":"EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. \n\nSecurity Fix(es):\n\n* edk2: Pre-boot RCE in EDK II PXE driver (CVE-2026-97631)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.","status":"published","published":"2026-11-10T12:09:45.660151Z","modified":"2026-11-10T12:30:02.470514933Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-10T12:59:04.624749Z"},{"id":"UBUNTU-CVE-2026-97631","description":"EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality, Integrity, and Availability.","status":"published","published":"2026-10-22T17:17:00Z","modified":"2026-10-28T20:17:27.248445067Z","cvss":[{"version":"4.0","score":9.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"},{"version":"4.0","score":9.5,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H","level":"critical"}],"updated_at":"2026-11-02T16:57:48.647391Z"},{"id":"ALSA-2026:96240","title":"Critical: edk2 security update","description":"EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM.   \n\nSecurity Fix(es):  \n\n  * edk2: Pre-boot RCE in EDK II PXE driver (CVE-2026-97631)\n\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n","status":"published","published":"2026-11-09T00:00:00Z","modified":"2026-11-10T22:15:02.328928818Z","updated_at":"2026-11-10T22:44:38.930463Z"},{"id":"AZL-111944","title":"CVE-2026-97631 affecting package edk2 20240524git3e722403cd16-21","description":"EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds\nWrite”, Classic\nBuffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability\ncan lead to arbitrary\ncode execution. It could also impact\nConfidentiality,\nIntegrity,\nand Availability.","status":"published","published":"2026-10-22T17:17:02Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:18.705965Z"},{"id":"AZL-112172","title":"CVE-2026-97631 affecting package qemu 10.1.0-2","description":"EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds\nWrite”, Classic\nBuffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability\ncan lead to arbitrary\ncode execution. It could also impact\nConfidentiality,\nIntegrity,\nand Availability.","status":"published","published":"2026-10-22T17:17:02Z","modified":"2026-11-03T05:33:06Z","updated_at":"2026-11-05T16:41:19.001909Z"}]}}