Code-execution flaw in UEFI firmware threatens most servers on planet Earth

CVE-2026-97631 doesn’t affect home and small office users, or any other users who boot their devices solely from disk drives. Instead, it applies only to organizations with machines that boot from local networks, or conceivably from Internet-connected resources. Even then, the targeted firmware must rely on EDK2, as opposed to a different reference implementation, and use the PXE functionality (which is turned on by default).

In an email, Intel said that none of its “commercial products currently under security support” are known to be affected. “Intel does not include the affected EDK2 functionality in its reference code, though it may be integrated by an OEM board vendor or system manufacturer,” the company added. It advised customers to check with their system manufacturer for specific guidance. Publicly available Intel reference code, however, makes reference to EDK2. Further, TianoCore has said that each Intel-supplied UEFI development kit “is a fully validated implementation… for a specific revision of the EDK II source.” Many other Intel documents reference EDK2 as well.

Arm, meanwhile, responded to a list of questions with: “CVE-2026-97631 is not directly applicable to Arm’s product portfolio.” Like Intel, firmware the company makes available also borrows heavily from EDK2. TianoCore has also documented Arm’s reliance on EDK2.

While it’s possible some platforms are free of EDK2 code, it’s prudent for users of all servers to investigate if CVE-2026-97631 affects them.

Questions sent to AMD, Phoenix Technologies, AMI, Microsoft, and Amazon—likely some of the other biggest organizations affected—went unanswered when this post went live. Without concrete answers to questions about the use of EDK2 by organizations like these, it’s impossible to say what or how devices are affected and what actions, if any, these organizations, or their users, should take. Representatives from the TianoCore Project also didn’t respond.

Source: arstechnica.com — article syndicated from the publisher’s feed; all rights remain with the original publisher.