CVE-2026-97631

EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality, Integrity, and Availability.

CVSS

9.5

EPSS

0.004 (37.4th percentile)

CISA KEV

Not listed

Exploitation

No report

Public exploits

None seen

State

PUBLISHED

Coverage

• 

  ServeTheHome / The Next Platform / KitGuru / HotHardware◇Specialist. Specialist publisher: established trade press, or expert analysis with a track record3 hours ago

  Critical UEFI Flaw Exposes Millions Of Servers To Hijacking Threat

  A newly-revealed UEFI exploit has entered the public sphere as CVE-2026-97631, and since it targets the TianoCore EDK2 open source codebase used by virtually all major manufacturers for their servers' UEFI firmware, enterprise and datacenter

  ↗hothardware.com/news/critical-uefi-flaw-exposes…(opens the publisher's site in a new tab)

What we observed