Ars Technica detailed a critical buffer overflow in EDK II's PXE network-boot code, tracked as CVE-2026-97631 (CVSS 9.5 per TianoCore's 22 October advisory), which can let an attacker with adjacent-network access run code before Secure Boot and other startup defences load — on a machine booting over the network, with no credentials or prior access.