Christiaan Stoudt (@cstoudt) on X

What it is

CVE-2026-97631 is a critical (9.5) flaw in TianoCore EDK II, the open-source code under much of the UEFI firmware on PCs and servers. Alex Matrosov (listed as Anthropic) and Dan Holmes-Mitra (listed as Google) found it. Christiaan Stoudt's thread argues that headlines saying "almost all servers on earth are affected" overstate the real exposure, which is narrow.

Preconditions / Affected

Reach is wide because EDK II is widely embedded, but exploitation needs several conditions at once:

flowchart LR
    A[Machine PXE booting now] --> D[Boot freeze]
    B[Attacker on same network] --> D
    C[Oversized ICMP error sent in boot window] --> D
    D --> E{Exact firmware build known?}
    E -->|Yes| F[Code execution]
    E -->|No| G[Freeze only]

• The machine is actively booting over the network (PXE) during the attack, which lasts a few seconds.
• The attacker already has a foothold on that network and sends an oversized ICMP error message.
• Code execution, as opposed to a frozen boot, also needs the exact firmware build.
• A normal boot from the local drive does not enter this path. Pressing the power button on such a machine does not open the window.
• Wake-on-LAN is not the flaw. A machine that is woken remotely and is also set to boot from the network first would let an attacker open the window on demand.
• Secure Boot does not help, because the flaw runs before those checks.

What to do

• Find machines with network boot first in the boot order, and any still used for imaging or provisioning. Stoudt says these are the ones at risk.
• Turn off network boot in BIOS/firmware where it is not used. Stoudt says this closes the path. Many home machines have it enabled but never use it.
• Check machines that combine Wake-on-LAN with network-first boot.
• Watch for vendor firmware updates. The fix has been in EDK II main since 15 October 2026 but is not in a stable release, and Stoudt had seen no vendor announce firmware containing it.

Caveats

Disclosure was planned for January, but an early public pull request broke the embargo. There is no known exploitation, and the CVE is not on CISA's known-exploited list. The thread says it will link a main article in a comment, and that article is not in the fetched text. The thread gives no firmware versions, vendor list or detection method.