Most server boot firmware carries a flaw that lets attackers run code

Most server firmware carries a critical flaw. Attackers who reach a server during its boot can run their own code before any defence loads.

The flaw is tracked as CVE-2026-97631. It sits in TianoCore EDK II. That is the open-source reference code most server BIOS vendors use. AMI, Insyde, Phoenix and Microsoft's Project Mu fork all use the vulnerable component. The TianoCore advisory rates it 9.5 out of 10.

Alex Matrosov of Anthropic and Dan Holmes-Mitra of Google found the flaw and reported it. They had a January disclosure date in place. AMI then published a public code change last month with the fix. That change showed attackers what to look for. Dan Goodin at Ars Technica reports that the TianoCore project went public with its advisory last week. The fix was already visible on GitHub by then.

The driver that runs when a server boots from a local network is called the PXE Base Code driver. It keeps a 504-byte buffer named Mode.IcmpError for incoming ICMP error messages. The copy loop does not stop at 504 bytes, in both the IPv4 and IPv6 handlers. A longer message writes attacker-controlled bytes past the end of the buffer.

An attacker on the local network sends a crafted ICMP message during the boot sequence. The code then runs at the most privileged level on the CPU, called ring 0. It runs before Secure Boot and the server's security chip can check for tampering. HD Moore, who created Metasploit, spoke to Ars Technica about this flaw. He said an attacker with short network access can use it to break disk encryption.

The flaw does not affect a laptop or desktop that boots from its own disk. It affects servers and other devices that boot from a local network. That setting is on by default in many data centres.

Jesse Michael, a researcher at firmware security firm Eclypsium, told Ars that the fix is a single code change. Admins deploy it as a BIOS or UEFI update, with no key rotation involved.

Intel told Ars Technica that none of its commercial products currently under security support are known to be affected. Arm said the CVE is not directly applicable to its product portfolio. AMD, Phoenix Technologies, AMI, Microsoft and Amazon had not answered Ars by publication time.

A team running production servers should ask the firmware vendor for guidance. They should also consider turning network boot off while the fix propagates, and watch logs for attempts. Secure Boot and the server's security chip do not protect against this flaw. A server with both enabled is still exposed.

Discovery by Anthropic's own security team shows an AI company doing serious vulnerability work. The target is the infrastructure its own inference servers run on. Anthropic has not published its own write-up of CVE-2026-97631.

Source

• Code-execution flaw in UEFI firmware affects most servers on planet Earth, Dan Goodin, Ars Technica.
• Pre-boot RCE in EDK II PXE driver, TianoCore project advisory.