CVE-2026-97631criticalCWE-120CWE-131CWE-787

CVE-2026-97631: critical vulnerability in TianoCore EDK2

Pre-boot RCE in EDK II PXE driver

Published · Updated

Follow this CVE+ Monitor edk2+ Monitor edk2

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

48Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 9.5epss 0.6%
from disclosure to weapon6 days
Published on NVDOct 22
1st PoC+6d
EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality, Integrity, and Availability.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Affected products
TianoCore · EDK2
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — TianoCore EDK2

In the same product, most dangerous first.

CVE-2025-2296HIGHUn-verified kernel bypass Secure Boot mechanism in direct boot modeEPSS 0.8%CVE-2024-38796MEDIUMInteger overflow in PeCoffLoaderRelocateImageEPSS 0.4%CVE-2025-2295LOWPotential iSCSI R2T PDU VulnerabilityEPSS 0.2%CVE-2024-38805MEDIUMiSCSI Remote Memory Corruption and Denial of ServiceEPSS 0.2%CVE-2024-38797MEDIUMOut-of-bounds Read in HashPeImageByType()EPSS 0.2%CVE-2025-3770HIGHSMM IDT Privilege Escalation VulnerabilityEPSS 0.2%