---
id: CVE-2026-97631
title: Pre-boot RCE in EDK II PXE driver
summary: >-
  EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds

  Write”, Classic

  Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access.
  Successful exploitation of this vulnerability

  can lead to arbitrary…
severity: critical
cvss: 9.5
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'
cvssSource: cna
cwe:
  - CWE-120
  - CWE-131
  - CWE-787
vendor: TianoCore
product: NetworkPkg
affected:
  - NetworkPkg <= edk2-stable202608
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T16:37:13.437Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-97631'
references:
  - url: 'https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m'
tags:
  - cve.org
ingestedAt: '2026-10-22T22:00:50.345Z'
---

## Overview

EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds
Write”, Classic
Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability
can lead to arbitrary
code execution. It could also impact
Confidentiality,
Integrity,
and Availability.

## Affected

- `NetworkPkg <= edk2-stable202608`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.