CODE-EXECUTION FLAW IN UEFI FIRMWARE AFFECTS MOST SERVERS ON PLANET EARTH

Summary from the TLDR InfoSec newsletter

A 16-year-old buffer overflow in TianoCore EDK2's PXE Base Code driver (CVE-2026-97631, CVSS 9.5), the reference UEFI code behind most server firmware, allowed an attacker to send an oversized ICMP error during network boot and execute ring 0 code before Secure Boot and the TPM chain of trust loaded. An AMI pull request leaked the fix months ahead of a January coordinated disclosure, although exploitation required local network access and per-model address tuning. Defenders should request patched firmware from their UEFI vendors, disable PXE boot where feasible, and monitor network boot segments for anomalous ICMP traffic.