Quick answers
- Is CVE-2026-97631 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-97631 being exploited in the wild.
- How severe is CVE-2026-97631?
- Informational severity, published 22 October 2026.
- Which products and versions are affected?
- Tianocore Edk2 master as of 2026-09-14.
- Is there a fix for CVE-2026-97631?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-97631 attacked?
- It is attacked over the network, in device firmware.
- Am I affected by CVE-2026-97631?
- Check whether you run Tianocore Edk2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A buffer overflow exists in the EDK2 PXE Base Code driver (NetworkPkg/UefiPxeBcDxe) in both IPv4 and IPv6 ICMP error handlers. The vulnerability is triggered by incorrect bounds checking when copying ICMP error messages into a fixed 504-byte field; an oversized message causes out-of-bounds writes past the intended buffer. An unauthenticated remote attacker can deliver a unicast ICMP error message during the PXE boot window to corrupt DXE-phase memory and achieve arbitrary code execution at ring 0, before Secure Boot verification or OS load.
Affected products
- TianoCore EDK2 master as of 2026-09-14
Timeline
- 2026-10-22: disclosed
- 2026-09-14: other: vulnerability present in master branch as of this date