Critical Flaw in Widely Used UEFI Firmware Code Puts Servers Worldwide at Risk

Defenders around the world are dealing with another poorly handled security disclosure, this time involving boot-time firmware that is used by most server vendors and data centers.

The flaw carries a severity rating of 9.5 out of 10. It sits in TianoCore EDK II, an open source codebase that hardware makers and cloud providers rely on to build the UEFI firmware that runs while a machine starts up. Last year, a representative of the UEFI Forum described EDK2 as the "preeminent solution / implementation of the UEFI specifications."

Nearly all UEFI suppliers, which are sometimes still called independent BIOS vendors, use the reference code extensively. That group includes AMI, Insyde and Phoenix. Project Mu, Microsoft's hardened fork of EDK2, also used the code containing the vulnerable component.

The bug is tracked as CVE-2026-97631. It is a memory-corruption problem in an ICMP component, and attackers can exploit it to execute malicious code before the operating system and firmware are able to put defenses in place. One of those defenses is Secure Boot, which builds a chain of trust covering all code loaded during startup, including the Trusted Platform Module (TPM).

The final payloads delivered through this flaw do not persist, meaning they run only once. Even so, they could give attackers a wide opening to install additional payloads that run early in the boot process every time a machine starts.

The flaw was discovered by Alex Matrosov of Anthropic and Dan Holmes of Google. They had arranged for it to remain confidential until a coordinated disclosure scheduled for January.

That plan fell apart when AMI, a maker of motherboards and other hardware, published a pull request last month that described the vulnerability and included a code fix. After the discovering parties noticed the post, TianoCore Project members released a public advisory last week.

With patch code now publicly available, it should be easy for advanced hackers to work out how the vulnerability is triggered and to build working exploits. The urgency is compounded by how hard UEFI fixes are to roll out. Patching firmware across millions of devices sold and used by thousands of hardware makers and cloud providers is cumbersome and slow.

The news arrives six days after another botched disclosure, that one involving a critical code-execution vulnerability in the PHP programming language.