October 28, 2026
- CVE-2026-97631 (CVSS 9.5) is a memory-corruption bug in the ICMP component of TianoCore EDK II, the reference implementation nearly all UEFI suppliers — AMI, Insyde, Phoenix, and Microsoft's hardened Project Mu fork — build on. Code runs before Secure Boot and TPM measurement can establish a chain of trust; final payloads don't persist, but they create room to install ones that run early on every boot. Discovered by Alex Matrosov (Anthropic) and Dan Holmes (Google) with coordinated disclosure set for January, the bug leaked when AMI published a pull request last month detailing it with a fix, forcing TianoCore to issue a public advisory (Ars Technica). (discussion) · Vulnerabilities & Exploits
in Pre-Boot RCE in EDK2 Breaks Cover Months Before Its Disclosure Date