Researchers from Anthropic and Google have discovered a critical vulnerability in the TianoCore EDK II codebase, an open-source project used by hardware vendors and cloud providers to build UEFI firmware. This exact interface initializes the moment a device powers on, long before the operating system and antivirus protection load, making it a particularly sensitive layer. The vulnerability has been designated CVE-2026-97631 with a severity score of 9.5 out of 10, and according to RBC, the bug had resided in the codebase for approximately 16 years.
Attack Mechanism: Memory Corruption Prior to OS Boot
The issue arises during network boot operations on servers over a local area network. A specific UEFI firmware component responsible for handling network messages fails to validate their size. An attacker with network access can send specially crafted data, corrupt device memory, and disrupt operations before the operating system even starts. Such a scenario paves the way for stealthy device control at a level inaccessible to traditional security tools.
Who Is Actually at Risk
Standard home computers booting from their own SSD or hard drive are not threatened by this vulnerability. The risk is concentrated in corporate servers and data centers, where equipment boots over the network using PXE technology. The network loader acts as the primary entry point for the attack, leaving infrastructure and cloud platforms most exposed.
Vendor Positions and Premature Disclosure
Intel representatives stated that their supported commercial products do not contain the vulnerable code by default, though it could have been integrated directly by motherboard manufacturers. Arm stated that the issue does not directly affect its products. A separate risk stems from the disclosure dynamics itself: according to information underlying the article, AMI published a fix ahead of schedule, making vulnerability details public prematurely and increasing the likelihood of rapid exploit development.
Recommendations for Administrators and the "Eternal" Nature of the Problem
Experts recommend that server administrators temporarily disable PXE network booting if it is not in use and monitor hardware vendors for firmware updates. Experts also warn that CVE-2026-97631 could become yet another "eternal" problem for end-of-life systems: updating UEFI across millions of devices from thousands of manufacturers is a complex and lengthy process that is rarely completed before the vulnerability is exploited.
