CVE-2026-97631 TianoCore CVE debrief

Who should care

Defenders and administrators of systems utilizing EDK2, especially those with NetworkPkg, should assess exposure and apply necessary remediation to prevent potential pre-boot RCE exploitation.

Why it matters

CVE-2026-97631 is a critical vulnerability in EDK II PXE driver that could allow pre-boot remote code execution, impacting Confidentiality, Integrity, and Availability. Defenders and administrators of EDK2 deployments should assess exposure and apply remediation.

• Potential for pre-boot remote code execution.
• Impact on Confidentiality, Integrity, and Availability.
• Need for immediate assessment and remediation of EDK2 deployments.
• Verification of system updates to versions beyond edk2-stable202608.

Technical summary

The vulnerability in EDK2's NetworkPkg allows for pre-boot remote code execution due to 'Out-of-bounds Write', Classic Buffer Overflow, and 'Incorrect Calculation of Buffer Size'. This could lead to arbitrary code execution impacting Confidentiality, Integrity, and Availability. The issue arises from a flawed handling of network packets in the PXE driver, which can be exploited by remote attackers to execute code before the operating system loads. Successful exploitation requires network access and could allow attackers to gain control over the system before the OS boots. Defenders and administrators of EDK2 deployments should assess exposure and apply necessary remediation to prevent potential pre-boot RCE.

Defensive priority

High priority should be given to assessing exposure and applying remediation, particularly for systems utilizing EDK2, focusing on updating to a version beyond edk2-stable202608.

Recommended defensive actions

• Assess exposure of EDK2 deployments, particularly focusing on versions up to edk2-stable202608.
• Verify and apply updates to EDK2, specifically for the NetworkPkg, to versions beyond edk2-stable202608.
• Monitor system logs for potential exploitation attempts targeting the EDK II PXE driver.
• Review and enhance network security controls to prevent pre-boot exploitation.
• Perform an inventory of assets using EDK2 to prioritize remediation efforts.
• Consider rollback or change windows for applying patches to minimize disruption.
• Track and verify the effectiveness of implemented mitigations and patches.

Evidence notes

The CVE record and source item detail provide information on the vulnerability in EDK2, specifically within the NetworkPkg. References include advisories from TianoCore and discussions on potential impacts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.