A memory-corruption vulnerability in boot-time firmware used by most of the world's server vendors and data centers has been made public ahead of schedule, handing attackers a roadmap to exploit it.

The flaw, rated 9.5 out of 10 for severity, sits in the TianoCore EDK II open source codebase, which hardware makers and cloud providers rely on to build the UEFI firmware that runs during boot. The UEFI Forum has described EDK2 as the preeminent implementation of its specifications. Nearly every UEFI supplier uses the reference code heavily, including AMI, Insyde and Phoenix, and Microsoft's hardened EDK2 fork, Project Mu, also carried the vulnerable component.

Tracked as CVE-2026-97631, the bug is a memory-corruption issue in an ICMP component. Attackers could use it to run malicious code before the operating system and before defenses such as Secure Boot establish a chain of trust for code loaded during boot, including the Trusted Platform Module. Payloads delivered through the flaw do not persist and run only once, but they can open the door to other payloads that execute early in every boot.

The researchers who found the flaw had arranged to keep it under wraps until a coordinated disclosure scheduled for January. That plan unraveled when AMI published a pull request last month detailing the vulnerability and including a code fix. Once the discovering parties learned of the post, TianoCore Project members issued a public advisory last week.

With patch code now public, skilled attackers can readily work out how to trigger the flaw and build working exploits. Patching UEFI code across millions of devices sold by thousands of hardware makers and cloud providers is slow and laborious, which adds to the pressure on defenders. The disclosure follows another premature release six days earlier involving a critical code-execution flaw in the PHP programming language.

Source: Ars Technica