CVE-2026-97631: Pre-boot RCE in EDK II PXE driver
Vulnerability summary
CVE-2026-97631 is a critical (CVSS 9.5) vulnerability in tianocore edk2. EPSS estimates a 0.64% chance of exploitation in the next 30 days, higher than 50.4% of scored vulnerabilities.
Severe, CVSS 9.5 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)
Source freshness unavailable
How is this decided?Timeline
- 22-10-2026PublishedVulnerability first disclosed.
- 30-10-2026Last modifiedVulnerability information updated.
Description
EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality, Integrity, and Availability.
CVSS metrics
4 scores · 4 sources · 1 version- NVDNIST9.5CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · DebianEcosystem advisory · calculated9.5CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated9.5CriticalCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS trend
Probability
0.64%
Chance of exploitation in the next 30 days
Percentile
50%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-120Buffer Copy without Checking Size of InputThe product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
- CWE-131Incorrect Calculation of Buffer SizeThe product does not correctly calculate the size to be used when allocating a buffer.
- CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu2 products
- edk2All versions (No fix recorded)
- edk2-hweAll versions (No fix recorded)
Debian1 product
- edk2All versions (No fix recorded)
Tianocore1 product
- edk2≤ edk2-stable202608
3 vendors · 4 products
