> status: mostly fine. patch anyway.practical AI security · est. 2026

Calm down. · Both

Calm down: the UEFI bug in "most servers on planet Earth" only bites while a server network-boots

By alkizz ·

On Oct 27, Ars Technica ran "Code-execution flaw in UEFI firmware affects most servers on planet Earth," which is the kind of headline that gets forwarded to a CISO with no comment and a lot of exclamation points. The bug is real and it's rated Critical, but before you start pulling servers off the rack, it helps to know that it only fires during one short window, while a machine is booting over the network with PXE.

The bug is CVE-2026-97631, a buffer overflow in the PXE Base Code driver (NetworkPkg/UefiPxeBcDxe) of TianoCore's EDK II, the open-source reference code that, per Ars, virtually all UEFI firmware suppliers use extensively. Per the TianoCore advisory published Oct 22, the driver copies incoming ICMP error messages into "the fixed 504-byte field Mode.IcmpError," gets the bounds wrong in both the IPv4 and IPv6 handlers, and so an oversized message "writes attacker-controlled bytes past the field." The advisory rates it 9.5 Critical under CVSS 4.0, and NVD carries the same score from TianoCore.

The advisory is clear about the window: the attacker has to deliver a unicast ICMP error message to the client's IP "from any network distance," but "the exposure window is the duration of the PXE boot." Ars adds the practical reading, which is that "some level of control over a local network is a prerequisite," and that "There's no evidence yet that CVE-2026-97631 provides an initial entry point into a network."

Even with that access, there are two outcomes, and only one of them is scary. The easy one is a hung boot, which the advisory calls a "denial of OS provisioning / recovery," and the hard one is code execution, which per the advisory needs an attacker "who knows the target firmware build." Jesse Michael of Eclypsium explained to Ars why that matters: "it's not something that you can throw a single exploit at any target and get RCE across a diverse range of devices, but it needs to be tuned for each target model/version/configuration since the addresses will change based on those." So in practice, per Ars, the attacker has to be inside already, then catch the boot and know the build. Calm down.

Claimed vs. confirmed

What the doom version says What the sources say
"Most servers on planet Earth" are at risk Ars says it applies only to machines that boot from the network, and only if their firmware uses EDK II's PXE code (which Ars notes is turned on by default). It "doesn't affect home and small office users, or any other users who boot their devices solely from disk drives"
Attackers can hit any server from the internet The packet can come "from any network distance," per the advisory, but it has to land during the PXE boot, and Ars treats local network control as a prerequisite
One exploit owns everything Code execution needs the target firmware build, and per Eclypsium it has to be tuned for each model, version and configuration
It's being exploited Neither the TianoCore advisory nor Ars reports any exploitation, and CVE-2026-97631 isn't in CISA's Known Exploited Vulnerabilities (KEV) catalog as of the Oct 27 update (how to read KEV)
This needs another Secure Boot revocation mess Eclypsium's Michael says it "can be fixed with a basic code fix, which will require deploying a BIOS/UEFI update," without the revocations and key-database updates that bugs like BootHole and BlackLotus needed

The leak is the messy part, and per Ars the finders had arranged for the bug to stay private until a coordinated disclosure scheduled for January, but a public pull request, which Ars attributes to AMI, detailed the bug and the fix in September. The TianoCore member who published the advisory later wrote on GitHub that "embargo was violated due to a mistake, resulting in the PR being created in the open." The upstream fix merged into EDK II on Oct 14 (Oct 15 UTC), but it isn't in a tagged EDK II stable release yet, the advisory page still says "Not patched currently," and either way an upstream fix doesn't help you until your server maker ships firmware with it.

The boring lesson

In practice this bug most likely starts where an intrusion is already under way (Ars found no evidence yet that it's a way in), so it's a way to dig in deeper, and that's also why it isn't nothing. HD Moore told Ars that an attacker who already has short-term network access could hijack the boot while it still has access to the TPM and "break disk encryption," which "would be even easier in a theft scenario," and he said it's likely a "forever" bug that will live on in end-of-support systems. Vendor answers so far are thin: Intel told Ars that none of its "commercial products currently under security support" are known to be affected, though an OEM or system maker may have added the code, and Arm said the CVE "is not directly applicable to Arm's product portfolio." AMD, Phoenix, AMI, Microsoft and Amazon hadn't answered Ars when it published.

My take: Security FUD making a strong play for the doom title vs AI FUD. Another nothing burger amplified by a "major" security publication and security rockstars for clicks and giggles.

What to do:

Sources

Related

More briefs

← All briefs