External risk intelligence

EDK2 BIOS Out-of-bounds Write Leading to Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.5)

CVE-2026-97631

EDK2 is a reference implementation of UEFI firmware. While the vulnerability mentions remote access as a potential vector for code execution, UEFI/BIOS interfaces are fundamentally low-level, hardware-bound components that operate beneath the operating system and are not internet-facing services or applications in common real-world network deployments.

Buffer Overflow

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in the EDK2 BIOS firmware that could allow remote attackers to execute arbitrary code, potentially impacting confidentiality, integrity, and availability. While the technical details point to significant risks, the primary concern for leadership is to confirm the relevance and exposure of this vulnerability within your specific environment, as it affects low-level system firmware.

Vulnerability in system firmware allows remote code execution.
Critical to confirm relevance and potential exposure.
Understand potential impact on system integrity.

Attack Path

How an attacker could exploit the issue

An attacker could potentially reach the vulnerability in EDK2's BIOS by leveraging remote access. This exposure allows for interaction with the vulnerable component, leading to an out-of-bounds write, classic buffer overflow, or incorrect calculation of buffer size. Successful exploitation could result in arbitrary code execution and impact confidentiality, integrity, and availability.

Remote access is required.
Out-of-bounds writes or buffer overflows trigger it.
Arbitrary code execution is the risk.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in EDK2's BIOS could allow an unauthenticated remote attacker to execute arbitrary code by causing an out-of-bounds write, classic buffer overflow, or incorrect calculation of buffer size. This could potentially impact the confidentiality, integrity, and availability of the system.

System code execution could be affected.
Remote access may lead to exposure.
Compromise of system integrity and availability.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in EDK2 impacts the fundamental BIOS layer, suggesting that platform or infrastructure teams managing firmware are the primary stakeholders. The initial step is to pinpoint where this firmware is deployed, assess its accessibility and criticality, identify the accountable owners, and then plan remediation based on the identified risks.

Ownership: Platform and infrastructure teams.
Verify first: Affected systems and exposure.
Action: Plan coordinated firmware updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is EDK2 and why does it have a BIOS vulnerability?

EDK2 is an open-source development kit that provides a reference implementation for UEFI firmware. UEFI acts as the foundational software layer that initializes your hardware and boots your operating system. Because it operates at such a deep level of the system architecture, any flaws in its code can have widespread effects on how the computer manages data and system security.

What does CVE-2026-97631 mean by buffer overflow?

This CVE involves weaknesses known as CWE-120 (Buffer Copy without Checking Size), CWE-131 (Incorrect Calculation of Buffer Size), and CWE-787 (Out-of-bounds Write). In plain terms, these mean the firmware fails to properly measure or limit the data being written to memory. An attacker can use this to overwrite adjacent memory areas, which can cause the system to behave unpredictably or run unauthorized code.

How can an attacker trigger this firmware flaw?

The vulnerability requires remote interaction with the firmware. It is important to note that local physical access is not the only way to interact with these systems; however, the flaw is not triggered by simple network packets sent to a standard application. It requires specific, crafted communication that reaches the underlying firmware layer, which is generally designed to be isolated from common user-level network traffic.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal assesses this as very unlikely to be an immediate concern for most. While the vulnerability theoretically allows for remote code execution, EDK2 is a low-level firmware component that resides beneath the operating system. It is not an internet-facing application, and standard network deployments do not typically expose these hardware-bound interfaces directly to the open web.

What should I do if I manage systems running this firmware?

Since this involves fundamental BIOS firmware, the responsibility lies with platform and infrastructure teams rather than standard software administrators. Your first step is to inventory your systems to locate where this firmware is deployed. Once identified, prioritize assessing the criticality of those machines and prepare to coordinate firmware updates through your hardware manufacturer's official support channels.

References

github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.