What is the CVSS score and severity of CVE-2026-97631?

CVE-2026-97631 is rated CRITICAL with a CVSS score of 9.5 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) and is classified under CWE-120 (Buffer Copy without Checking Size of Input).

CVE-2026-97631 CRITICAL · CVSS 9.5 · TianoCore / EDK II — UEFI Network Boot Firmware (EDK II) · 2026-10-28

CVE-2026-97631: TianoCore EDK II UEFI PXE Base Code Driver

Q: What versions are affected by CVE-2026-97631?

CVE-2026-97631 affects UEFI firmware built on TianoCore EDK II with NetworkPkg/UefiPxeBcDxe and PXE network boot enabled in UEFI Network Boot Firmware (EDK II) (TianoCore EDK II UEFI PXE Base Code Driver).

Q: How do I patch or remediate CVE-2026-97631?

To remediate CVE-2026-97631, upgrade to the patched release: EDK II Upstream Fix / Server Vendor BIOS & UEFI Updates. Disable PXE / network boot in BIOS/UEFI configuration on all servers and workstations that boot from local storage. Isolate bare-metal provisioning VLANs so only hardened DHCP/TFTP boot servers can send ICMP traffic to hosts during PXE boot. Apply vendor UEFI/BIOS firmware updates incorporating the upstream TianoCore EDK II NetworkPkg patch as they are released.

A 16-year-old buffer overflow in the ICMPv4/ICMPv6 error handlers (PxeBcIcmpErrorDpcHandle and PxeBcIcmp6ErrorDpcHandle) of TianoCore EDK II’s PXE Base Code driver copies oversized ICMP error packets past a fixed 504-byte buffer, enabling ring-0 code execution during network boot prior to OS and Secure Boot enforcement.

Identifier

CVE-2026-97631

Vendor / Product

TianoCore / EDK II · UEFI Network Boot Firmware (EDK II)

Severity / CVSS

CRITICAL · CVSS 9.5

Vector / CWE

CWE-120 (Buffer Copy without Checking Size of Input)

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Affected

UEFI firmware built on TianoCore EDK II with NetworkPkg/UefiPxeBcDxe and PXE network boot enabled

Patched Version

EDK II Upstream Fix / Server Vendor BIOS & UEFI Updates

Priority

P0 — Disable Unused PXE Boot & Apply Vendor UEFI Updates

Executive Summary & Technical Impact

Tracked under CVE-2026-97631 (CWE-120 (Buffer Copy without Checking Size of Input)), this vulnerability affects UEFI firmware built on TianoCore EDK II with NetworkPkg/UefiPxeBcDxe and PXE network boot enabled and carries a severity score of 9.5 (CRITICAL). Engineering and security operations teams running UEFI Network Boot Firmware (EDK II) should prioritize upgrading to EDK II Upstream Fix / Server Vendor BIOS & UEFI Updates.

Remediation & Patch Guidance

Disable PXE / network boot in BIOS/UEFI configuration on all servers and workstations that boot from local storage.
Isolate bare-metal provisioning VLANs so only hardened DHCP/TFTP boot servers can send ICMP traffic to hosts during PXE boot.
Apply vendor UEFI/BIOS firmware updates incorporating the upstream TianoCore EDK II NetworkPkg patch as they are released.

Frequently Asked Questions (CVE-2026-97631)

What versions are affected by CVE-2026-97631?

CVE-2026-97631 affects UEFI firmware built on TianoCore EDK II with NetworkPkg/UefiPxeBcDxe and PXE network boot enabled in UEFI Network Boot Firmware (EDK II) (TianoCore EDK II UEFI PXE Base Code Driver).

How do I patch or remediate CVE-2026-97631?

Upgrade affected deployments to EDK II Upstream Fix / Server Vendor BIOS & UEFI Updates and verify the remediation steps listed above.

What is the CVSS score of CVE-2026-97631?

CVE-2026-97631 is rated CRITICAL with a CVSS score of 9.5 (vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

Full TechPulse Investigation

CVE-2026-97631: A 16-Year-Old EDK2 PXE Bug Puts Server Boot Firmware at Risk

A buffer overflow in the TianoCore EDK II network boot driver lets an attacker on the network run code before the OS and Secure Boot take over, and an early leak means the patch is already public.

Read full engineering post-mortem (6 min read) →