After PHP, another critical flaw puts server security at risk
What's the story
A major security vulnerability has been discovered in TianoCore EDK II, an open-source code commonly used to develop UEFI firmware. The flaw, tracked as CVE-2026-97631, is a memory corruption issue with a severity score of 9.5 out of 10. It could allow hackers to execute malicious code on servers before they even boot up. The vulnerability was first reported online last month but was originally scheduled for disclosure in January 2027.
Impact assessment
Vulnerability affects devices booting over the network
The EDK II flaw primarily affects servers in data centers and enterprises that boot over a network.
It could potentially impact "most servers" on Earth, according to Ars Technica.
The vulnerability is located in the PXE Base Code driver, which enables devices like servers and storage equipment to boot using code downloaded from a network.
Exploitation risk
Hacker would need detailed knowledge of target firmware
The advisory on the vulnerability warns that an unauthenticated network attacker can deliver ICMP error messages to a PXE-booting machine.
This could corrupt DXE-phase memory and execute arbitrary code before the operating system loads, even before Secure Boot or measured boot has verified any OS component.
However, it should be noted that a hacker would need detailed knowledge of the target firmware to successfully run their code.
Patch implications
Public patch code could aid hackers in developing exploits
The public patch code for the EDK II flaw could give hackers a head start in developing exploits, even before vendors distribute firmware updates.
However, it is important to note that the vulnerability does not impact users who boot solely from disk drives.
So far, there have been no reports of confirmed exploitation or a comprehensive list of affected products.
Corporate reactions
Intel and Arm respond to EDK II vulnerability
In response to the EDK II vulnerability, Intel has confirmed that none of its supported commercial products are known to be affected.
Meanwhile, Arm has said that the flaw is "not directly applicable to Arm's product portfolio."
The disclosure comes after a critical PHP code-execution flaw was discovered by OpenAI, which was thought to affect up to 70% of the world's websites.