CVE-2026-97631

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97631", "assignerOrgId": "65518388-201a-4f93-8712-366d21fe8d2c", "state": "PUBLISHED", "assignerShortName": "TianoCore", "dateReserved": "2026-09-24T16:56:45.359Z", "datePublished": "2026-10-22T16:32:27.619Z", "dateUpdated": "2026-10-30T19:34:40.851Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "65518388-201a-4f93-8712-366d21fe8d2c", "shortName": "TianoCore", "dateUpdated": "2026-10-22T16:37:13.437Z"}, "title": "Pre-boot RCE in EDK II PXE driver", "datePublic": "2026-10-22T16:32:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-120", "description": "CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-131", "description": "CWE-131 Incorrect calculation of buffer size", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds write", "type": "CWE"}]}], "affected": [{"vendor": "TianoCore", "product": "EDK2", "packageName": "NetworkPkg", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "edk2-stable202608", "versionType": "custom"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "EDK2 contains a vulnerability in BIOS where a user may cause \u201cOut-of-bounds\nWrite\u201d, Classic\nBuffer Overflow, and \u201cIncorrect Calculation of Buffer Size\u201d by remote access. Successful exploitation of this vulnerability\ncan lead to arbitrary\ncode execution. It could also impact\nConfidentiality,\nIntegrity,\nand Availability.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>EDK2 contains a vulnerability in BIOS where a user may cause \u201cOut-of-bounds\nWrite\u201d, Classic\nBuffer Overflow, and \u201cIncorrect Calculation of Buffer Size\u201d by remote access. Successful exploitation of this vulnerability\ncan lead to arbitrary\ncode execution. It could also impact\nConfidentiality,\nIntegrity,\nand Availability.</p>"}]}], "references": [{"url": "https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "CRITICAL", "baseScore": 9.5, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H"}}], "credits": [{"lang": "en", "value": "Alex Matrosov (Anthropic)", "type": "finder"}, {"lang": "en", "value": "Dan Holmes-Mitra (Google)", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-28T16:06:34.929Z"}, "references": [{"url": "https://arstechnica.com/security/2026/10/code-execution-flaw-in-uefi-firmware-threatens-most-servers-on-planet-earth/"}, {"url": "https://news.ycombinator.com/item?id=50265393"}, {"url": "https://github.com/microsoft/mu_basecore/pull/1990"}, {"url": "https://github.com/microsoft/mu_basecore/pull/1989"}, {"url": "http://www.openwall.com/lists/oss-security/2026/10/28/4"}], "title": "CVE Program Container", "x_generator": {"engine": "ADPogram 0.0.1"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-30T19:34:29.002368Z", "id": "CVE-2026-97631", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T19:34:40.851Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://arstechnica.com/security/2026/10/code-execution-flaw-in-uefi-firmware-threatens-most-servers-on-planet-earth/"}, {"url": "https://news.ycombinator.com/item?id=50265393"}, {"url": "https://github.com/microsoft/mu_basecore/pull/1990"}, {"url": "https://github.com/microsoft/mu_basecore/pull/1989"}, {"url": "http://www.openwall.com/lists/oss-security/2026/10/28/4"}], "x_generator": {"engine": "ADPogram 0.0.1"}, "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2026-10-28T16:06:34.929Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-97631", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-30T19:34:29.002368Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T19:34:36.093Z"}}], "cna": {"title": "Pre-boot RCE in EDK II PXE driver", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Alex Matrosov (Anthropic)"}, {"lang": "en", "type": "finder", "value": "Dan Holmes-Mitra (Google)"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.5, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "TianoCore", "product": "EDK2", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "edk2-stable202608"}], "packageName": "NetworkPkg", "defaultStatus": "unaffected"}], "datePublic": "2026-10-22T16:32:00.000Z", "references": [{"url": "https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m"}], "x_generator": {"engine": "Vulnogram 1.0.5"}, "descriptions": [{"lang": "en", "value": "EDK2 contains a vulnerability in BIOS where a user may cause \u201cOut-of-bounds\nWrite\u201d, Classic\nBuffer Overflow, and \u201cIncorrect Calculation of Buffer Size\u201d by remote access. Successful exploitation of this vulnerability\ncan lead to arbitrary\ncode execution. It could also impact\nConfidentiality,\nIntegrity,\nand Availability.", "supportingMedia": [{"type": "text/html", "value": "<p>EDK2 contains a vulnerability in BIOS where a user may cause \u201cOut-of-bounds\nWrite\u201d, Classic\nBuffer Overflow, and \u201cIncorrect Calculation of Buffer Size\u201d by remote access. Successful exploitation of this vulnerability\ncan lead to arbitrary\ncode execution. It could also impact\nConfidentiality,\nIntegrity,\nand Availability.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-120", "description": "CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-131", "description": "CWE-131 Incorrect calculation of buffer size"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "CWE-787 Out-of-bounds write"}]}], "providerMetadata": {"orgId": "65518388-201a-4f93-8712-366d21fe8d2c", "shortName": "TianoCore", "dateUpdated": "2026-10-22T16:37:13.437Z"}}}, "cveMetadata": {"cveId": "CVE-2026-97631", "state": "PUBLISHED", "dateUpdated": "2026-10-30T19:34:40.851Z", "dateReserved": "2026-09-24T16:56:45.359Z", "assignerOrgId": "65518388-201a-4f93-8712-366d21fe8d2c", "datePublished": "2026-10-22T16:32:27.619Z", "assignerShortName": "TianoCore"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "NetworkPkg", "product": "EDK2", "vendor": "TianoCore", "versions": [{"lessThanOrEqual": "edk2-stable202608", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "infosec@edk2.groups.io"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "EDK2 contains a vulnerability in BIOS where a user may cause \u201cOut-of-bounds\nWrite\u201d, Classic\nBuffer Overflow, and \u201cIncorrect Calculation of Buffer Size\u201d by remote access. Successful exploitation of this vulnerability\ncan lead to arbitrary\ncode execution. It could also impact\nConfidentiality,\nIntegrity,\nand Availability."}], "id": "CVE-2026-97631", "lastModified": "2026-10-30T20:17:39.517", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.5, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "infosec@edk2.groups.io", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-97631", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-30T19:34:29.002368Z", "version": "2.0.3"}}]}, "published": "2026-10-22T17:17:02.027", "references": [{"source": "infosec@edk2.groups.io", "url": "https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.openwall.com/lists/oss-security/2026/10/28/4"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://arstechnica.com/security/2026/10/code-execution-flaw-in-uefi-firmware-threatens-most-servers-on-planet-earth/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/microsoft/mu_basecore/pull/1989"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/microsoft/mu_basecore/pull/1990"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://news.ycombinator.com/item?id=50265393"}], "sourceIdentifier": "infosec@edk2.groups.io", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-120"}, {"lang": "en", "value": "CWE-131"}, {"lang": "en", "value": "CWE-787"}], "source": "infosec@edk2.groups.io", "type": "Secondary"}]}

{"bugzilla": {"description": "edk2: Pre-boot RCE in EDK II PXE driver", "id": "2559129", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2559129"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.8", "cvss3_scoring_vector": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["EDK2 contains a vulnerability in BIOS where a user may cause \u201cOut-of-bounds\nWrite\u201d, Classic\nBuffer Overflow, and \u201cIncorrect Calculation of Buffer Size\u201d by remote access. Successful exploitation of this vulnerability\ncan lead to arbitrary\ncode execution. It could also impact\nConfidentiality,\nIntegrity,\nand Availability.", "A flaw was found in EDK2. Due to improper buffer size calculations in the firmware, an unauthenticated remote attacker can trigger a buffer overflow. Successful exploitation can lead to arbitrary code execution or cause a denial of service (DoS)."], "name": "CVE-2026-97631", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "edk2", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "edk2", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "edk2", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-22T16:32:27Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-97631\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97631\nhttps://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m"], "threat_severity": "Critical"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,edk2-stable202608]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "EDK2", "source": "cna", "vendor": "TianoCore"}, "product": "edk2", "vendor": "tianocore"}], "created": "2026-10-22T18:00:11.186026+00:00", "updated": "2026-10-22T19:00:16.053813+00:00", "vendors": ["tianocore", "tianocore$PRODUCT$edk2"]}