# CVE-2026-97631: Code-Execution Flaw in TianoCore EDK II UEFI Firmware (PXE ICMP Error Handlers) Affects Most Servers

> A buffer overflow in the ICMP error-message handlers of the TianoCore EDK II PXE Base Code driver (NetworkPkg/UefiPxeBcDxe) lets an unauthenticated network attacker corrupt memory during PXE boot, causing denial of service or, with knowledge of the target firmware, code execution in the DXE phase before the OS and Secure Boot controls load. AMI, Insyde, Phoenix and Microsoft's Project Mu build on the affected reference code. Rated CVSS v4.0 9.5.

- **Published:** 2026-10-27T23:36:13Z
- **Last reviewed:** 2026-10-27T23:36:13Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4579
- **ID:** TL-2026-4579
- **Severity:** CRITICAL (CVSS 9.5)
- **Category:** VULNERABILITY
- **Status:** TRACKING
- **Detections:** 9 · **IOCs:** 13 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-97631

## Description

CVE-2026-97631 (GitHub advisory GHSA-99cj-7hg9-mp4m, published by NVD on 2026-10-22 at 17:17 UTC) affects the PXE Base Code driver in EDK II's NetworkPkg (UefiPxeBcDxe). The functions PxeBcIcmpErrorDpcHandle (IPv4) and PxeBcIcmp6ErrorDpcHandle (IPv6) copy incoming ICMP error messages into the fixed 504-byte Mode.IcmpError field with incorrect bounds handling. For a message longer than 504 bytes the copy loop still writes bytes past the field, producing an out-of-bounds write (CWE-120, CWE-131, CWE-787).

An unauthenticated attacker able to send unicast ICMP error messages to a machine that is actively PXE booting can trigger the overflow; no authentication or user interaction is required (CVSS v4.0 AV:N/AC:L/AT:P/PR:N/UI:N, with high confidentiality, integrity and availability impact on both vulnerable and subsequent systems). The advisory states the corruption is deterministic and yields CPU exceptions and boot hangs (denial of service). An attacker who knows the target firmware can plant counterfeit events and execute arbitrary code in the DXE phase at Ring 0, before the operating system loads, bypassing Secure Boot and measured boot. Press coverage (Ars Technica, via mirror) reports that such code runs before Secure Boot, which establishes the chain of trust for all later code, and before TPM-based protections can act, and that it can be used to install payloads that run early in each boot. The final payload itself is reported to lack persistence (it runs once per boot).

Scope as reported: machines that boot from network resources using the default-enabled PXE functionality on EDK2-based firmware; machines booting only from local disk are reported as not affected. EDK II is the reference implementation used by AMI, Insyde, Phoenix and Microsoft's Project Mu, so a large share of servers and data-center hardware inherit the code. The GHSA lists EDK II master as of 2026-09-14 as affected; NVD records the affected NetworkPkg range as versions 0 through edk2-stable202608.

The upstream fix (pull request #13302, opened 2026-10-14 by Michael D Kinney, approved by four reviewers and merged 2026-10-15) corrects the buffer offset calculations and bounds validation in both handlers in NetworkPkg/UefiPxeBcDxe/PxeBcSupport.c, truncates oversized ICMP packets at buffer capacity, clears the buffer before copying fragments, and adds unit tests for IPv4/IPv6 fragment packing and truncation. PR #13200 is linked as related refactoring. Note a source discrepancy: the GHSA page still showed 'not yet patched' while the PR was already merged. As of 2026-10-27 the Debian security tracker lists bookworm, trixie and forky/unstable edk2 packages as vulnerable/unfixed (Debian bug #1151853, rated a minor issue for trixie, no DSA). The advisory documents no workarounds. Downstream firmware vendor and OEM updates must be tracked separately; their availability is not stated in the sources. The sources do not report in-the-wild exploitation, a public PoC, or attribution to any actor. The bug class resembles the 2024 PixieFail set (CVE-2023-45229 to CVE-2023-45237) in the same NetworkPkg. BeaconBeagle correlation was not applicable: the sources list no network IOCs (IPs/domains).

## MITRE ATT&CK

- T1542.001 System Firmware
- T1542.003 Bootkit
- T1542.003 Bootkit
- T1685 Disable or Modify Tools
- T1499.004 Application or System Exploitation

## Sources

- [NVD: CVE-2026-97631](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-97631)
- [GitHub Security Advisory GHSA-99cj-7hg9-mp4m (tianocore/edk2)](https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m)
- [tianocore/edk2 PR #13302: NetworkPkg/UefiPxeBcDxe: Fix ICMP buffer overflow in IPv4/IPv6 handle](https://github.com/tianocore/edk2/pull/13302)
- [Debian Security Tracker: CVE-2026-97631](https://security-tracker.debian.org/tracker/CVE-2026-97631)
- [Ars Technica: Code-execution flaw in UEFI firmware threatens most servers on planet Earth](https://arstechnica.com/security/2026/10/code-execution-flaw-in-uefi-firmware-threatens-most-servers-on-planet-earth/)
- [Eclypsium News: Ars Technica coverage of UEFI code-execution flaw](https://eclypsium.com/news/ars-technica-code-execution-flaw-in-uefi-firmware-affects-most-servers-on-planet-earth/)
- [Mirror of Ars Technica article (content verified)](https://physicalainews.com/code-execution-flaw-in-uefi-firmware-threatens-most-servers-on-planet-earth/)
- [Quarkslab: PixieFail, nine vulnerabilities in TianoCore's EDK II IPv6 network stack](https://blog.quarkslab.com/pixiefail-nine-vulnerabilities-in-tianocores-edk-ii-ipv6-network-stack.html)
- [CERT/CC VU#132380: PixieFail EDK II NetworkPkg vulnerabilities](https://kb.cert.org/vuls/id/132380)
- [SecurityWeek: PixieFail flaws in TianoCore EDK II PXE implementation (related prior NetworkPkg research)](https://www.securityweek.com/remotely-exploitable-pixiefail-flaws-found-in-tianocore-edk-ii-pxe-implementation/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4579