A memory-corruption vulnerability has been identified in the ICMP component of TianoCore EDK II, the open-source foundation for UEFI firmware. Tracked as CVE-2026-97631, the flaw received a severity score of 9.5 out of 10 due to its potential for widespread impact across global server infrastructure.
Because EDK II serves as the primary implementation of UEFI specifications, the vulnerability affects a vast array of hardware manufacturers and cloud services. Major independent BIOS vendors such as Phoenix, Insyde, and AMI rely heavily on this reference code. Even Microsoft's security-focused fork, Project Mu, utilized the compromised component.
What it means
The vulnerability allows malicious code to run during the boot process, occurring before the operating system even starts. This timing is critical because the exploit bypasses essential security layers like Secure Boot, which is designed to maintain a chain of trust for the Trusted Platform Module and other startup code. By executing at this level, an attacker can undermine the fundamental defenses that protect a server's integrity from the moment it is powered on.
