Threat reportVulnerabilityTL-2026-4579
CVE-2026-97631: Code-Execution Flaw in TianoCore EDK II UEFI Firmware (PXE ICMP Error Handlers) Affects Most Servers
CVE-2026-97631 (TL-2026-4579), also tracked as GHSA-99cj-7hg9-mp4m, is a critical-severity software vulnerability scored CVSS 9.5, first published 2026-10-27. It has no confirmed attribution, affects TianoCore EDK II (NetworkPkg/UefiPxeBcDxe PXE Base Code driver), references 1 CVE (CVE-2026-97631), maps to 4 MITRE ATT&CK techniques (T1499.004, T1542.001, T1542.003), and is covered by 9 detection rules and 13 indicators of compromise.
- CVSS
- 9.5/10Critical
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 4MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 13Indicators of compromise
Key facts for TL-2026-4579
- Threat ID
- TL-2026-4579
- Also known as
- GHSA-99cj-7hg9-mp4m, EDK II PXE ICMP buffer overflow
- Severity
- CRITICAL
- CVSS
- 9.5 (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)
- Status
- TRACKING
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- cloud and data centers, enterprise it, server infrastructure
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 13
How CVE-2026-97631 works
A buffer overflow in the ICMP error-message handlers of the TianoCore EDK II PXE Base Code driver (NetworkPkg/UefiPxeBcDxe) lets an unauthenticated network attacker corrupt memory during PXE boot, causing denial of service or, with knowledge of the target firmware, code execution in the DXE phase before the OS and Secure Boot controls load. AMI, Insyde, Phoenix and Microsoft's Project Mu build on the affected reference code. Rated CVSS v4.0 9.5.
CVE-2026-97631 (GitHub advisory GHSA-99cj-7hg9-mp4m, published by NVD on 2026-10-22 at 17:17 UTC) affects the PXE Base Code driver in EDK II's NetworkPkg (UefiPxeBcDxe). The functions PxeBcIcmpErrorDpcHandle (IPv4) and PxeBcIcmp6ErrorDpcHandle (IPv6) copy incoming ICMP error messages into the fixed 504-byte Mode.IcmpError field with incorrect bounds handling. For a message longer than 504 bytes the copy loop still writes bytes past the field, producing an out-of-bounds write (CWE-120, CWE-131, CWE-787).
An unauthenticated attacker able to send unicast ICMP error messages to a machine that is actively PXE booting can trigger the overflow; no authentication or user interaction is required (CVSS v4.0 AV:N/AC:L/AT:P/PR:N/UI:N, with high confidentiality, integrity and availability impact on both vulnerable and subsequent systems). The advisory states the corruption is deterministic and yields CPU exceptions and boot hangs (denial of service). An attacker who knows the target firmware can plant counterfeit events and execute arbitrary code in the DXE phase at Ring 0, before the operating system loads, bypassing Secure Boot and measured boot. Press coverage (Ars Technica, via mirror) reports that such code runs before Secure Boot, which establishes the chain of trust for all later code, and before TPM-based protections can act, and that it can be used to install payloads that run early in each boot. The final payload itself is reported to lack persistence (it runs once per boot).
Scope as reported: machines that boot from network resources using the default-enabled PXE functionality on EDK2-based firmware; machines booting only from local disk are reported as not affected. EDK II is the reference implementation used by AMI, Insyde, Phoenix and Microsoft's Project Mu, so a large share of servers and data-center hardware inherit the code. The GHSA lists EDK II master as of 2026-09-14 as affected; NVD records the affected NetworkPkg range as versions 0 through edk2-stable202608.
The upstream fix (pull request #13302, opened 2026-10-14 by Michael D Kinney, approved by four reviewers and merged 2026-10-15) corrects the buffer offset calculations and bounds validation in both handlers in NetworkPkg/UefiPxeBcDxe/PxeBcSupport.c, truncates oversized ICMP packets at buffer capacity, clears the buffer before copying fragments, and adds unit tests for IPv4/IPv6 fragment packing and truncation. PR #13200 is linked as related refactoring. Note a source discrepancy: the GHSA page still showed 'not yet patched' while the PR was already merged. As of 2026-10-27 the Debian security tracker lists bookworm, trixie and forky/unstable edk2 packages as vulnerable/unfixed (Debian bug #1151853, rated a minor issue for trixie, no DSA). The advisory documents no workarounds. Downstream firmware vendor and OEM updates must be tracked separately; their availability is not stated in the sources. The sources do not report in-the-wild exploitation, a public PoC, or attribution to any actor. The bug class resembles the 2024 PixieFail set (CVE-2023-45229 to CVE-2023-45237) in the same NetworkPkg. BeaconBeagle correlation was not applicable: the sources list no network IOCs (IPs/domains).
MITRE ATT&CK techniques used in TL-2026-4579
Impact
T1499.004 Application or System Exploitation
Persistence
T1542.001 System Firmware; T1542.003 Bootkit
Defense Evasion
defense-impairment
Affected products and versions in CVE-2026-97631
- TianoCore — EDK II (NetworkPkg/UefiPxeBcDxe PXE Base Code driver)
Vulnerable versions: master as of 2026-09-14; NetworkPkg 0 through edk2-stable202608
Fixed in: Upstream fix merged via PR #13302 on 2026-10-15 - AMI, Insyde, Phoenix Technologies, Microsoft (Project Mu) — UEFI firmware built on EDK II reference code
Vulnerable versions: Firmware incorporating the affected PXE Base Code driver; specific builds not stated - Debian — edk2 package
Vulnerable versions: bookworm 2022.11-6+deb12u1; bookworm 2022.11-6+deb12u2; trixie 2025.02-8+deb13u1; forky/sid 2026.08+ds-2
Remediation for CVE-2026-97631
Patches
- Upstream EDK II fix: tianocore/edk2 pull request #13302 (merged 2026-10-15), NetworkPkg/UefiPxeBcDxe/PxeBcSupport.c
- Vendor firmware updates incorporating the fix: availability not stated in sources
- Debian edk2 packages (bookworm, trixie, forky/sid) listed as unfixed in the Debian security tracker
Immediate actions
- Inventory servers with EDK II-based firmware (AMI, Insyde, Phoenix, Project Mu derived) that have PXE network boot enabled
- Disable PXE/network boot in firmware setup on systems that boot only from local disk (local-disk-only boot is reported as not affected)
- Restrict PXE boot to isolated, trusted provisioning VLANs and filter unexpected ICMP/ICMPv6 error messages toward booting hosts
Workarounds
- No workaround is documented in the advisory; disabling PXE network boot is a risk-reduction measure for hosts that do not need it
Longer-term hardening
- Track OEM and firmware vendor advisories and deploy updated firmware that includes the upstream EDK II fix (PR #13302)
- Monitor firmware integrity and boot-chain measurements (TPM PCR attestation) for unexpected changes
- Audit firmware build pipelines that vendor the EDK II NetworkPkg for the PXE Base Code driver
- Track distribution packages (e.g. Debian edk2, bug #1151853) for the backported fix
CVEs associated with CVE-2026-97631
Weaknesses (CWE) in CVE-2026-97631
Timeline of CVE-2026-97631
- Quarkslab publishes PixieFail (CVE-2023-45229 to CVE-2023-45237), nine flaws in the same EDK II NetworkPkg, establishing the PXE network stack as an attack surface
- EDK II master as of this date is listed as affected by the PXE Base Code ICMP overflow
- Michael D Kinney opens tianocore/edk2 PR #13302 (NetworkPkg/UefiPxeBcDxe: Fix ICMP buffer overflow in IPv4/IPv6 handle), referencing CVE-2026-97631 and related refactoring PR #13200
- PR #13302 merged into tianocore/edk2 after approvals from four reviewers (SaloniKasbekar, Zclarkwilliams, leiflindholm, makubacki); adds bounds checks, buffer clearing and IPv4/IPv6 truncation unit tests
- NVD record last modified at 17:40 UTC, listing NetworkPkg versions 0 through edk2-stable202608 as affected and CWE-120, CWE-131, CWE-787
- CVE-2026-97631 published in NVD (17:17 UTC) with CVSS v4.0 score 9.5; GHSA-99cj-7hg9-mp4m credits Alex Matrosov (Anthropic) and Dan Holmes-Mitra (Google)
- Debian security tracker (bug #1151853) lists edk2 in bookworm, trixie and forky/unstable as vulnerable/unfixed; no DSA issued
- Ars Technica reports the flaw threatens most servers; Eclypsium news page redirects to the coverage
Sources cited for CVE-2026-97631
- NVD: CVE-2026-97631
- GitHub Security Advisory GHSA-99cj-7hg9-mp4m (tianocore/edk2)
- tianocore/edk2 PR #13302: NetworkPkg/UefiPxeBcDxe: Fix ICMP buffer overflow in IPv4/IPv6 handle
- Debian Security Tracker: CVE-2026-97631
- Ars Technica: Code-execution flaw in UEFI firmware threatens most servers on planet Earth
- Eclypsium News: Ars Technica coverage of UEFI code-execution flaw
- Mirror of Ars Technica article (content verified)
- Quarkslab: PixieFail, nine vulnerabilities in TianoCore's EDK II IPv6 network stack
- CERT/CC VU#132380: PixieFail EDK II NetworkPkg vulnerabilities
- SecurityWeek: PixieFail flaws in TianoCore EDK II PXE implementation (related prior NetworkPkg research)
Detection coverage for TL-2026-4579
As of 2026-10-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4579 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.