NexusSec.Firmware flaws are easy to ignore because they are hard to patch. This one is worth a few minutes, because the main mitigation is simple and the affected feature is often switched on by default. This post reflects what was published up to 1 November 2026.
What happened
On 22 October 2026, TianoCore, the project behind EDK II, published an advisory for CVE-2026-97631, rated 9.5 out of 10. EDK II is open-source UEFI firmware code that many firmware makers use as a base. The flaw is a buffer overflow in the PXE network-boot driver: when it copies ICMP error messages into a fixed-size buffer, the size checks are wrong in both the IPv4 and IPv6 code. According to The Hacker News, the flawed code dates back to 2010.
Who is affected
- Machines that boot over the network, mainly servers and data-centre equipment. PXE boot is enabled by default in the standard EDK II build.
- Machines that boot only from a local disk are not affected.
- Red Hat, SUSE and Debian listed their EDK II packages, which among other things provide firmware for virtual machines, as affected and not yet fixed.
How serious is it?
The attacker needs no password, but must be on an adjacent network and send a crafted ICMP error message while the target is booting over the network. The straightforward result is a crash that hangs the boot. Running code is much harder and depends on the exact firmware build, but it would happen before Secure Boot and other boot-time checks. As of the reports, there was no known exploitation, and the flaw was not in CISA's Known Exploited Vulnerabilities catalogue.
Fix status
A fix was merged into EDK II's main branch on 15 October, and Microsoft's Project Mu published builds containing it on 26 October, but no stable EDK II release included it as of 28 October. For physical servers, the fix arrives as a BIOS or UEFI update from the hardware vendor, so the timing depends on them.
What to do
- List the servers and appliances that use PXE boot, and disable PXE in the firmware settings wherever you do not need it.
- Keep provisioning and PXE networks in their own segment, reachable only by the machines that need them. See network segmentation.
- Watch your server vendors' firmware advisories and apply BIOS or UEFI updates when they ship.
- Update virtual machine firmware packages on your hypervisors when your Linux distribution releases the fix.
- Monitor boot-time network traffic on provisioning networks, as the advisory suggests.
The flaw was credited to researchers Alex Matrosov of Anthropic and Dan Holmes-Mitra of Google. Coordinated disclosure had been planned for January 2027, but the details became public early.
