Code-execution flaw in UEFI firmware affects most servers on planet Earth
Critical flaw in EDK2 allows attackers to execute code early in the boot process.
Critical flaw in EDK2 allows attackers to execute code early in the boot process.
The short version
- Defenders across the world face the burden of responding to yet another botched code-execution vulnerability, this time in boot-time firmware used by most of the world’s server vendors and data centers.
- The parties that discovered CVE-2026-97631—Alex Matrosov of Anthropic and Dan Holmes of Google—had arranged for it to stay under wraps until a coordinated disclosure that was scheduled for January.
- AMI, a maker of motherboards and other hardware, published this pull request last month that detailed the vulnerability and included a code fix.
What happened
Once the post came to the attention of the discovering parties, TianoCore Project members published a public advisory last week. Like CVE-2026-97631, exploitation or use of these payloads is appealing because it allows attackers to infect machines early in the boot process, before TPM and other defenses load, so they can inflict maximum damage.
Why it matters
Given the ubiquity of CVE-2026-97631, Moore said it’s likely a “forever” bug that will live on in end-of-support systems.
Summary by Nerd News Network. Read the full article at Ars Technica via the links above and below.