TianoCore EDK II UEFI flaw CVE-2026-97631 allows pre-boot code execution

A critical code-execution vulnerability has surfaced in boot-time firmware used by most of the world's server vendors and data centers. Ars Technica reports that the flaw, tracked as CVE-2026-97631 and rated 9.5 out of 10 for severity, sits in TianoCore EDK II, an open source codebase that hardware makers and cloud providers use to build the UEFI firmware that runs during boot-up.

EDK II is everywhere in this industry. Last year a representative of the UEFI Forum called EDK2 the "preeminent solution / implementation of the UEFI specifications." Virtually all UEFI suppliers, sometimes still called IBVs or independent BIOS vendors, including AMI, Insyde and Phoenix, use the reference code extensively. Project Mu, Microsoft's hardened EDK2 fork, used the code containing the vulnerable component as well.

CVE-2026-97631 is a memory-corruption flaw in an ICMP component. Attackers can exploit it to run malicious code before the operating system and firmware can put defenses such as Secure Boot in place. Secure Boot establishes a chain of trust for all code loaded during boot, including the Trusted Platform Module (TPM). The final payloads delivered through the flaw have no persistence, meaning they run only once. But they can give attackers a wide opening to install other payloads that also run each time early in the boot process.

The disclosure did not go as planned. The discoverers, Alex Matrosov of Anthropic and Dan Holmes of Google, had arranged for the bug to stay private until a coordinated disclosure scheduled for January. Then AMI, a maker of motherboards and other hardware, published a pull request last month that detailed the vulnerability and included a code fix. Once that post came to the attention of the discoverers, TianoCore Project members published a public advisory last week.

The article's assessment is that the public patch code makes it trivial for advanced hackers to learn how the vulnerability is triggered and to build working exploits. Urgency is compounded by the fact that patching UEFI code vulnerabilities in millions of end devices sold and used by thousands of hardware makers and cloud providers is cumbersome and time-consuming. The news comes six days after another botched disclosure, this one involving a critical code-execution vulnerability in the PHP programming language.

Key facts

CVE-2026-97631 is a memory-corruption flaw in an ICMP component of TianoCore EDK II, rated 9.5 out of 10, that lets attackers run code before the OS and defenses like Secure Boot load.
EDK II is the reference code used extensively by virtually all UEFI suppliers, including AMI, Insyde and Phoenix, and by Microsoft's Project Mu fork.
Discoverers Alex Matrosov of Anthropic and Dan Holmes of Google had planned coordinated disclosure for January; an AMI pull request last month detailed the bug and included a fix, and TianoCore Project members published an advisory last week.
Final payloads run only once, but can open the way to other payloads that run on every early boot.
With the patch code public, Ars Technica says exploits will be trivial for advanced hackers to build, while patching UEFI across millions of devices is slow.

Why it matters

UEFI firmware runs before the operating system, so code executed there sits below the defenses most security tooling relies on. This flaw can run malicious code before the OS and firmware can apply protections like Secure Boot, and it lands in the reference codebase that virtually all UEFI suppliers use extensively. The disclosure was also botched: a fix and a description of the bug went public through an AMI pull request ahead of the coordinated January date, and it came six days after another botched disclosure involving a critical code-execution flaw in PHP.

Who it affects

Per the article, the firmware base is used by most of the world's server vendors and data centers, by hardware makers and cloud providers, and by the major UEFI suppliers AMI, Insyde and Phoenix. Microsoft's Project Mu, a hardened EDK2 fork, used the code containing the vulnerable component as well. The article describes millions of end devices sold and used by thousands of hardware makers and cloud providers as the patching burden.

How to use it

The source gives no step-by-step guidance. What it does establish: TianoCore Project members have published a public advisory, and the AMI pull request contains a code fix. Defenders and firmware teams can start from the advisory for CVE-2026-97631 and track fixes from their own hardware and firmware vendors.

How solid is it

The report comes from Ars Technica and names the CVE, the 9.5 out of 10 severity rating, the discoverers and their employers, and the sequence of the AMI pull request and the TianoCore advisory. The judgment that exploits will be trivial for advanced hackers is the article's own assessment, not a demonstrated exploit. Exact dates are given only as relative terms (last month, last week), and the January date has no year in the text.

Risks and caveats

The article warns that publicly available patch code makes it trivial for advanced hackers to learn how the flaw is triggered and to build working exploits, while patching UEFI vulnerabilities across millions of devices is cumbersome and time-consuming. That gap is the core risk. Payloads from the flaw run only once, but can be used to install others that run every time early in boot. The article does not say whether the flaw is exploitable over a network, does not mention exploitation in the wild, and does not give vendor-by-vendor patch status.

“With publicly available patch code, it will be trivial for advanced hackers to learn how the vulnerability is triggered and to build working exploits.”

— Ars Technica