---
id: CVE-2026-97631
title: Pre-boot RCE in EDK II PXE driver
summary: >-
  EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds

  Write”, Classic

  Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access.
  Successful exploitation of this vulnerability

  can lead to arbitrary…
severity: critical
cvss: 9.5
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'
cvssSource: cna
cwe:
  - CWE-120
  - CWE-131
  - CWE-787
vendor: TianoCore
product: NetworkPkg
affected:
  - NetworkPkg <= edk2-stable202608
published: '2026-10-22'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T16:06:34.929Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-97631'
references:
  - url: 'https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-97631.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-97631'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2559129'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-97631'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97631'
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00483
epssPercentile: 0.41529
scores:
  cna: 9.5
  vendor: 8.8
ingestedAt: '2026-10-22T22:00:50.345Z'
---

## Overview

EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds
Write”, Classic
Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability
can lead to arbitrary
code execution. It could also impact
Confidentiality,
Integrity,
and Availability.

## Affected

- `NetworkPkg <= edk2-stable202608`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Critical · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-97631.json)