Critical UEFI firmware vulnerability disclosed prematurely, affects major vendors

What the vulnerability exposes

The vulnerability, tracked as CVE-2026-97631, resides in the EDK II open-source UEFI firmware code, which serves as the foundation for firmware from AMI, Insyde, Phoenix, and Microsoft’s Project Mu. The flaw allows attackers to execute arbitrary code at the processor’s most privileged level before Secure Boot checks are performed, effectively bypassing critical security protections.

According to reports, the bug is located in the driver enabling network boot (PXE). Attackers can exploit it by sending crafted ICMP error messages to overwrite memory, provided they have some level of control over the local network. This could include insiders or intruders who have already established a foothold in the network.

Premature disclosure disrupts coordinated fixes

The vulnerability was discovered by researchers Alex Matrosov of Anthropic and Dan Holmes-Mitra of Google, who had planned to disclose it in January 2027. However, the flaw was exposed prematurely due to a public code change signed off by an engineer at AMI. The early disclosure has left vendors scrambling to release patches, as no stable releases of affected firmware or Linux packages currently include fixes.

TianoCore merged a fix on 15 October, but as of 27 October, no stable releases incorporate it. Microsoft’s Project Mu released updated builds on 26 October, but broader adoption across affected vendors remains pending. Red Hat, SUSE, and Debian have acknowledged their EDK II packages are vulnerable and have not yet released patches.

Vendor responses and unaffected products

Intel and Arm have stated that their products are not directly affected by CVE-2026-97631, though device manufacturers may have included the vulnerable EDK II code in their implementations. AMD has not publicly commented on the flaw.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has not listed the flaw in its catalogue of exploited vulnerabilities as of 27 October, and no active exploits have been reported. However, researchers warn that the early disclosure increases the risk of exploitation, particularly in environments where PXE boot is enabled.

What this means

Lazyfounder analysis — our interpretation, not reported fact.

This premature disclosure underscores the fragility of supply-chain security in firmware development, where a single upstream change can ripple across multiple vendors. For operators of affected servers—particularly those relying on PXE boot for deployment or recovery—the lack of immediate patches means temporary mitigations, such as disabling network boot or isolating PXE traffic, may be necessary. The incident also highlights the risks of relying on open-source firmware components without robust vulnerability coordination processes.

Related on Lazyfounder

• Anthropic
• Google
• Microsoft
• AI cybersecurity startup Cathedral breached Anthropic’s systems via third-party software
• More technology news