CVE-2026-97631 appears to affect a narrow set of systems: organizations whose machines boot from resources on a local network or possibly the Internet, using firmware based on EDK2 and its default-enabled PXE functionality. Home users, small offices, and others who boot only from local disk drives are not affected. However, uncertainty remains around which vendors have incorporated the vulnerable EDK2 code into their firmware.
Limited exposure, but firmware configurations vary
Intel said in an email that none of its “commercial products currently receiving security support” are known to be affected. “Intel has not included the affected EDK2 features in its reference code, but they may be integrated by OEM board vendors and system manufacturers,” the company added. Intel advised customers to check with their system manufacturers for specific guidance.
Intel’s publicly available reference code references EDK2. TianoCore also states that each UEFI development kit Intel offers “is a fully verified implementation against a specific revision of the EDK II sources.” Numerous other Intel documents also refer to EDK2.
Arm responded to a series of questions by saying, “CVE-2026-97631 does not directly apply to Arm’s product portfolio.” However, Arm makes firmware available through its SystemReady project, and that firmware also borrows heavily from EDK2. TianoCore has documented Arm’s dependence on EDK2.
Vendors have not yet provided complete answers
Although some platforms may not include EDK2 code, it is prudent to investigate whether server users are affected by CVE-2026-97631.
At the time this article was published, AMD, Phoenix Technologies, AMI, Microsoft, and Amazon had not answered questions about the vulnerability. These companies appear to be among the other major organizations potentially affected. Without specific information about whether they use EDK2, it is impossible to determine whether or how their devices may be affected, or what actions the organizations and their users should take. Representatives of the TianoCore project also did not respond.
Source: arstechnica.com
