TianoCore disclosed a critical flaw in EDK II's network-boot code on October 22, 2026. CVE-2026-97631 lets an attacker who can deliver malicious network error messages to a machine during PXE boot execute code before its operating system loads, according to the project's advisory. For operators, the immediate question is which firmware builds contain the correction.
The public records need reading together. The advisory still lists no patched version, but the fix was merged into EDK II master on October 15. That establishes an upstream correction. It doesn't establish that a particular server's firmware contains it.
Exposure depends on network boot
PXE starts a machine from the network. The advisory limits this attack's window to that boot process over IPv4 or IPv6. It describes boot hangs and, for an attacker who knows the target firmware build, code execution in the firmware environment. The documented scenario doesn't describe an ordinary disk boot.
The original patch proposal, opened September 28, traces the fault to incorrect copying of ICMP error data. Oversized packets could overwrite adjacent memory. Its proposed repair adds boundary checks and corrects buffer offsets in both protocol handlers, truncating data when the destination fills. Those details explain why network reachability during provisioning or recovery deserves attention.
The patch record and the firmware question
The merged replacement pull request adds tests and clears the ICMP buffer before copying. Its author reports that unit tests fail before the change and pass afterward. These are the project's reported results; MrKeyoor hasn't reproduced the vulnerability or tested firmware images.
There is also a disclosure issue. In an October 27 comment on that pull request, TianoCore's jkmathews said a mistake had broken the embargo and exposed the patch publicly. The comment says private GitHub security advisories remain the recommended reporting route.
For a fleet owner, the useful follow-up is a supplier's affected-model list and corrected firmware build identifiers. The merged source change gives suppliers a specific repair to trace. Until that mapping is available for your hardware, the upstream merge alone cannot settle whether your machines have received it.