A critical 9.5/10 severity code-execution vulnerability (CVE-2026-97631) has been discovered in TianoCore EDK II, the open-source UEFI firmware foundation used by nearly all server vendors worldwide. Discovered by researchers from Anthropic and Google, the memory-corruption flaw in an ICMP component allows pre-boot code execution that bypasses Secure Boot protections, potentially enabling boot-level persistence on most servers on Earth.
Background
UEFI firmware and EDK II form the foundational boot layer for nearly all modern server hardware, sitting below the operating system in the trusted computing chain. Pre-boot vulnerabilities are particularly dangerous because they execute before Secure Boot and other OS-level defenses can engage.
- Source
- Lobsters
- Published
- Oct 28, 2026 at 05:18 PM
- Score
- 8.0 / 10