Technology
UEFI firmware flaw in TianoCore EDK II rated 9.5 out of 10
Slashdot reports CVE-2026-97631, a memory-corruption flaw that could let attackers run code before Secure Boot loads.
The short version
- Slashdot reports a code-execution flaw rated 9.5 out of 10 in TianoCore EDK II firmware code.[Slashdot]
- The memory-corruption flaw, tracked as CVE-2026-97631, sits in an ICMP component.[Slashdot]
- Per the report, attackers could run malicious code before the operating system and Secure Boot load.[Slashdot]
- Discoverers Alex Matrosov and Dan Holmes had planned coordinated disclosure for January.[Slashdot]
Key facts
- The vulnerability has a severity rating of 9.5 out of 10 and resides in TianoCore EDK II, an open source codebase used to create UEFI firmware.[Slashdot]
- The flaw is tracked as CVE-2026-97631 and is a memory-corruption flaw in an ICMP component.[Slashdot]
- Attackers could exploit the flaw to run malicious code before the operating system and protections such as Secure Boot load.[Slashdot]
- Alex Matrosov of Anthropic and Dan Holmes of Google discovered the flaw.[Slashdot]
- The discoverers had arranged to keep the flaw under wraps until a coordinated disclosure scheduled for January.[Slashdot]
What remains uncertain
- The verified ledger does not confirm the number of affected systems, patch availability, or whether exploits exist; these points are unverified. Basis: a single-outlet report with only three verified claims.[Slashdot]
Sources
Outlet counts describe coverage, not independent confirmation. Reports may share a wire service or original source.