Ars Technica detailed a critical buffer overflow in EDK II's PXE network-boot code, tracked as CVE-2026-97631 (CVSS 9.5 per TianoCore's 22 October advisory), which can let an attacker with adjacent-network access run code before Secure Boot and other startup defences load — on a machine booting over the network, with no credentials or prior access. Red Hat and SUSE, which ship the affected code, rate exploitation as possible from an adjacent network position rather than the open internet; no stable EDK II release contains a fix and the advisory lists no patched version, so most organisations have nothing to install today. Given EDK II underpins the UEFI firmware of most server hardware, the remediation posture is monitoring and network-segmentation of PXE/DHCP boot paths — and Intel/AMD server operators should treat the pending stable fix as a same-day-patch event when it lands.

• Source article