Critical UEFI firmware flaw threatens servers worldwide
Summarised from 3 outlets · Updated 28 Oct, 22:51 · Archive
A critical code-execution vulnerability in widely-used UEFI firmware puts most of the world's servers at risk.
A critical vulnerability in TianoCore EDK II, the open source codebase used by nearly all major UEFI firmware suppliers to build boot-time firmware, threatens most servers worldwide. The flaw, tracked as CVE-2026-97631 and rated 9.5 out of 10 in severity, is a memory-corruption bug in an ICMP component that allows attackers to execute arbitrary code before the operating system and firmware security defences can engage.
Virtually all UEFI suppliers—including AMI, Insyde, and Phoenix—use the TianoCore EDK II reference code extensively. Microsoft's Project Mu, a hardened fork of EDK2, also contained the vulnerable component. A UEFI Forum representative described EDK2 last year as the 'preeminent solution / implementation of the UEFI specifications'.
The vulnerability allows attackers to bypass critical security features like Secure Boot, which establishes a chain of trust for code loaded during boot, including the Trusted Platform Module. Although malicious payloads delivered through this flaw run only once and have no persistence, they can give attackers an opening to install additional payloads that execute early in every boot cycle.
Alex Matrosov of Anthropic and Dan Holmes of Google discovered the vulnerability and had arranged for coordinated disclosure in January. However, AMI published details and a code fix in a public pull request last month. Once the researchers discovered this, TianoCore Project members published a public advisory last week.
With patch code now publicly available, security experts warn that building working exploits will be trivial for sophisticated attackers. Given the fragmented market of UEFI manufacturers, remediating the flaw across all affected servers could take months, and no reports of active exploitation have emerged so far.
How it is being reported
- Most Servers on the Planet Are Vulnerable to This Firmware Code-Execution FlawThe critical flaw in UEFI firmware—used by most server vendors and data centers—allows attackers to execute code early in the boot process.Wired · 28 Oct, 20:30
- Most data centers and servers on the planet could be vulnerable to dangerous UEFI firmware flaw — here's what we knowA 9.5/10 flaw will take months to fully remediate, so stay on your guard.TechRadar · 28 Oct, 16:15
- Code-execution flaw in UEFI firmware threatens most servers on planet EarthCritical flaw in EDK2 allows attackers to execute code early in the boot process.Ars Technica · 27 Oct, 20:25
In this story: TianoCore EDK II · Anthropic · Google · AMI · Microsoft · Alex Matrosov · Dan Holmes
This summary was written by AI from the headlines and standfirsts above, and states as fact only what at least two outlets report. How we use AI · Report a problem · Corrections log
Comments (0)