CVE-2026-97631: Pre-boot RCE in EDK II PXE driver
CVE-2026-97631 is a vulnerability in Pre-boot RCE in EDK II PXE driver, rated Important by Microsoft. Microsoft has not reported exploitation in the wild. The EPSS model estimates a 0.64% probability of exploitation activity in the next 30 days, higher than 50% of all scored vulnerabilities. Microsoft released the fix on 31 October 2026, outside Patch Tuesday. It affects 2 products in 1 product family (Open Source Software).
Key facts
- CVE ID
- CVE-2026-97631
- Severity
- N/A
- Microsoft severity
- Important
- Exploited in the wild
- No
- Publicly disclosed
- No
- Weakness
- CWE-120; CWE-131; CWE-787
- EPSS
- 0.64% (percentile 50%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- October 2026 Patch Tuesday
- Product families
- Open Source Software
Affected products (2)
Open Source Software
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| azl3 edk2 20240524git3e722403cd16-20 on Azure Linux 3.0 | Release Notes | Security Update | ||
| azl3 qemu 10.1.0-1 on Azure Linux 3.0 | Release Notes | Security Update |
Exploitation and detection
Detection and weaponization
Weaponization maturity: Exploit.
Proof-of-concept repositories (3)
- slabbdev/uefi-pxe-cve-2026-97631 · 1 stars
- Try2Take/CVE-2026-97631-PoC · 1 stars
- RayanZiani/Bootjack
NIST NVD data
- NVD status
- Deferred
- NVD CVSS
- 9.5 (CRITICAL)
- NVD weakness
- CWE-120; CWE-131; CWE-787
- Published to NVD
- NVD last modified
References
- https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m
- http://www.openwall.com/lists/oss-security/2026/10/28/4
- https://arstechnica.com/security/2026/10/code-execution-flaw-in-uefi-firmware-threatens-most-servers-on-planet-earth/
- https://github.com/microsoft/mu_basecore/pull/1989
- https://github.com/microsoft/mu_basecore/pull/1990
- https://news.ycombinator.com/item?id=50265393
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. |