Critical UEFI flaw threatens most servers worldwide
Original: Code-execution flaw in UEFI firmware affects most servers on planet Earth
Why This Matters
Pre-OS code execution at firmware level can defeat most modern server security controls.
A memory-corruption bug (CVE-2026-97631) in TianoCore EDK2 UEFI firmware scores 9.5/10 severity and lets attackers execute code before Secure Boot defenses activate, affecting virtually all major server vendors and cloud providers.
A critical vulnerability in TianoCore EDK II—the open source UEFI reference codebase used by virtually every major hardware maker, including AMI, Insyde, Phoenix, and Microsoft's Project Mu fork—allows attackers to execute arbitrary code early in the boot sequence, before Secure Boot or TPM protections can engage. Tracked as CVE-2026-97631 with a CVSS score of 9.5, the flaw is a memory-corruption bug in an ICMP parser within EDK2's network stack.
Although payloads delivered through the flaw lack persistence on their own, they can be used to install additional early-boot implants or break disk encryption by accessing the TPM while it remains unprotected. Dragos CRO and Metasploit creator HD Moore warned the bug could allow an attacker with brief network access to hijack boot flow and compromise disk encryption.
The disclosure was forced prematurely: AMI published a pull request last month containing the vulnerability details and a patch, before a coordinated January disclosure could take place. Discoverers Alex Matrosov of Anthropic and Dan Holmes of Google had arranged the embargo; once AMI's post surfaced publicly, TianoCore published its advisory last week. With working patch code now public, building functional exploits is straightforward. Patching UEFI firmware across millions of devices from thousands of vendors is expected to take months.