Critical UEFI Firmware Flaw Exposes Millions of Servers to Early‑Boot Code Execution

A newly disclosed vulnerability, tracked as CVE‑2026‑97631, resides in the open‑source EDK II codebase that underpins UEFI firmware for the vast majority of server hardware. The flaw is a 16‑year‑old buffer overflow in the PXE‑Base Code driver’s ICMP handling routine, allowing an attacker on the same network to hijack execution flow before the operating system or Secure Boot can enforce any protections.

Scope and Severity

The Common Vulnerability Scoring System rates the issue at 9.5 out of 10. Because EDK II is the reference implementation used by independent BIOS vendors such as AMI, Insyde, and Phoenix — and even Microsoft’s hardened Project Mu fork — the impact spans virtually every data‑center server sold today. Exploitation yields a one‑time code execution window, but that window is sufficient to plant persistent boot‑time implants that survive reboots.

Disclosure was mishandled: a pull request containing the fix appeared publicly months before the coordinated release date, giving threat actors a head start on weaponization. Patching UEFI across millions of deployed systems remains a logistical challenge, as each hardware vendor must integrate, test, and distribute firmware updates to end users.

Why It Matters for GPU / AI Infrastructure

AI‑focused GPU clusters rely on the same server platforms that run this firmware. An early‑boot compromise can subvert the Trusted Platform Module, break disk encryption, and inject malicious kernels that intercept GPU workloads, exfiltrate model weights, or sabotage training jobs. Operators of GPU clouds must prioritize firmware rollout, enable measured boot attestation, and monitor for anomalous pre‑OS network traffic to mitigate exposure.