CVE-2026-97631

critical

Description

EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality, Integrity, and Availability.

References

References
More

https://thehackernews.com/2026/10/critical-16-year-old-uefi-flaw-can-run.html

https://arstechnica.com/security/2026/10/code-execution-flaw-in-uefi-firmware-threatens-most-servers-on-planet-earth/

https://github.com/RayanZiani/Bootjack

https://github.com/slabbdev/uefi-pxe-cve-2026-97631

https://news.ycombinator.com/item?id=50265393

https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m

https://github.com/microsoft/mu_basecore/pull/1990

https://github.com/microsoft/mu_basecore/pull/1989

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-108230

http://www.openwall.com/lists/oss-security/2026/10/28/4

Details

Source: Mitre, NVD

Published: 2026-10-22

Updated: 2026-10-30

Risk Information

CVSS v2

Base Score: 8.3

Vector: CVSS2#AV:A/AC:L/Au:N/C:C/I:C/A:C

Severity: High

CVSS v3

Base Score: 8.8

Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Severity: High

CVSS v4

Base Score: 9.5

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Severity: Critical

EPSS

EPSS: 0.00635