{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/project-mu--2026-10-27/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:tianocore:edk_ii:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-97631"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["TianoCore EDK II (\u003c= 2026-10-27)","Project Mu (\u003c= 2026-10-27)"],"_cs_severities":["critical"],"_cs_tags":["vulnerability","firmware","edk2","uefi","pxe"],"_cs_type":"advisory","_cs_vendors":["AMI","Insyde","Phoenix","Microsoft"],"content_html":"\u003cp\u003eCVE-2026-97631 is a memory-corruption vulnerability in the PXE-Base Code driver (NetworkPkg/UefiPxeBcDxe) of the open-source TianoCore EDK II reference implementation. The vulnerability stems from an incorrect bounds check in the ICMP error handling logic, where the driver fails to restrict the copy of ICMP error messages to a fixed 504-byte buffer. An attacker with local network access can send a malicious, oversized ICMP error packet during a PXE network boot sequence to overwrite adjacent memory, allowing execution of code in the UEFI environment (Ring 0). Exploitation can bypass Secure Boot and TPM attestation, as the code runs before these security mechanisms are initialized.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation enables arbitrary code execution at the UEFI firmware level (Ring 0), bypassing Secure Boot and TPM protections. While the initial payload lacks persistence, it can be used to install secondary payloads that reside in the firmware environment. Impact is limited to devices configured to boot from a network using EDK II-based firmware.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify systems within the environment that utilize PXE network booting for OS deployment or maintenance.\u003c/li\u003e\n\u003cli\u003eContact hardware vendors (OEMs) and server manufacturers to obtain and deploy BIOS/UEFI firmware updates that patch CVE-2026-97631.\u003c/li\u003e\n\u003cli\u003eDisable network boot (PXE) functionality on systems where it is not required for daily operations to reduce the attack surface.\u003c/li\u003e\n\u003cli\u003eImplement network segmentation to restrict access to PXE infrastructure, ensuring only authorized deployment servers can communicate with target endpoints.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-27T20:59:50Z","date_published":"2026-10-27T20:59:50Z","id":"https://feed.craftedsignal.io/briefs/2026-10-uefi-edk2-buffer-overflow/","summary":"A critical 16-year-old memory corruption flaw (CVE-2026-97631) in the EDK II PXE-Base Code driver allows attackers on the local network to execute arbitrary code with Ring 0 privileges during the early boot sequence.","title":"TianoCore EDK II: ICMP-based buffer overflow in PXE Base Code driver (CVE-2026-97631)","url":"https://feed.craftedsignal.io/briefs/2026-10-uefi-edk2-buffer-overflow/"}],"language":"en","title":"CraftedSignal Threat Feed - Project Mu (\u003c= 2026-10-27)","version":"https://jsonfeed.org/version/1.1"}