Skip to content
Fencer Intel
critical 9.5

CVE-2026-97631 json

Pre-boot RCE in EDK II PXE driver

published 20d ago modified 12d ago also EUVD-2026-108230 , GHSA-99cj-7hg9-mp4m

Unreviewed: the maintainers' own advisory

Published by the maintainers on their GitHub repository tianocore/edk2. GitHub has not reviewed it into the GitHub Advisory Database, so the affected packages and versions are the maintainers' word. Read the full advisory on GitHub.

cvss
9.5
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 50%
public exploits
0
none known

Summary

EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality, Integrity, and Availability.

Patch / fix

  • edk2-ovmf AlmaLinux 10 20251114-5.el10_2.3.alma.1
  • edk2-tools AlmaLinux 10 20251114-5.el10_2.3.alma.1
  • edk2-aarch64 AlmaLinux 10 20251114-5.el10_2.3.alma.1

almalinux advisories ALSA-2026:96240

  • edk2 Rocky Linux 10 20251114-5.el10_2.3

rocky linux advisories RLSA-2026:96240

Is CVE-2026-97631 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-97631 updated cvss 8.8

edk2: Pre-boot RCE in EDK II PXE driver

  • Red Hat Enterprise Linux 8 edk2, edk2-ovmf, edk2-aarch64 Red Hat Enterprise Linux 9 edk2, edk2-ovmf, edk2-tools, edk2-aarch64
    affected: no fix available
  • Red Hat Enterprise Linux AppStream (v. 10) edk2 20251114-5.el10_2.3, edk2-ovmf 20251114-5.el10_2.3, edk2-aarch64 20251114-5.el10_2.3 Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) edk2-ovmf 20251114-5.el10_2.3, edk2-tools 20251114-5.el10_2.3, edk2-aarch64 20251114-5.el10_2.3
    fixed: vendor fix RHSA-2026:96240
  • Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9
    not affected: component not present
  • Red Hat OpenShift Container Platform 5 openshift/ose-rhel-coreos-9
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
12d ago

Exploit prediction

0.64% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-11).

CVSS scores

assigned by version score vector
CNA 4.0 9.5 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CNA 4.0 9.5 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected products

  • TianoCore EDK2

Classification

Weakness
  • CWE-120 Buffer Copy without Checking Size of Input
  • CWE-131 Incorrect Calculation of Buffer Size
  • CWE-787 Out-of-bounds Write

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

The maintainers of tianocore/edk2 published their own advisory on GitHub. Reviewed sources take precedence over it.