A critical vulnerability has been discovered in UEFI firmware used by numerous server vendors and data centers, rated 9.5 out of 10 in severity. This memory-corruption flaw, identified as CVE-2026-97631, resides in the TianoCore EDK II codebase, which is widely utilized for developing UEFI firmware. Attackers could exploit this vulnerability to run malicious code before the operating system's defenses, such as Secure Boot, are in place. While the initial payloads do not persist, they may enable further malicious actions during the boot process.
Key facts
- The vulnerability is rated 9.5 out of 10 in severity.
- It is found in the TianoCore EDK II codebase.
- The flaw is tracked as CVE-2026-97631.
- Major UEFI suppliers include AMI, Insyde, and Phoenix.
- The vulnerability allows code execution before OS defenses are activated.
A short AI summary in our own words. The reporting belongs to Ars Technica; we don't reproduce it.