CVE-2026-97631: Pre-boot RCE in EDK II PXE driver
Published Oct 22, 2026
·Updated
EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality, Integrity, and Availability.
Affected Software
1 affected component
Tianocore EDK II PXE driver
Event History
Oct 22, 2026
CVE Published
via MITRE·04:32 PM
Data Sourced
via MITRE·04:32 PM
DescriptionWeakness
Frequently Asked Questions
1
Which systems are exposed?
Systems with a BIOS that includes the TianoCore EDK II PXE driver are the relevant population. The issue is reachable through remote access.
2
What does an attacker need to exploit this issue?
The available information identifies remote access as the attack vector. No requirement for local access or prior authentication is stated.
3
What is the potential impact of successful exploitation?
Successful exploitation can result in arbitrary code execution. Confidentiality, integrity, and availability may also be affected.