CVE-2026-97631

A flaw was found in EDK2. Due to improper buffer size calculations in the firmware, an unauthenticated remote attacker can trigger a buffer overflow. Successful exploitation can lead to arbitrary code execution or cause a denial of service (DoS).

This vulnerability is rated as Critical because an unauthenticated network attacker can execute arbitrary code within the pre-boot firmware execution environment without prior access privileges or user interaction. In Red Hat Enterprise Linux and OpenShift environments, EDK2 provides UEFI firmware for virtualized guests. The vulnerability is exposed exclusively during network boot sequences when the PXE driver processes untrusted network packets before the operating system initializes. Virtual machines booting strictly from local storage or operating in their normal post-boot runtime are not exposed to this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.