Buffer Overflow Vulnerability in EDK2 BIOS by TianoCore
CVE-2026-97631

9.5CRITICAL

Key Information:

Vendor

Tianocore

Status
Edk2
Vendor
CVE Published:
22 October 2026

What is CVE-2026-97631?

EDK2 BIOS by TianoCore exhibits a serious vulnerability that enables malicious users to perform an out-of-bounds write due to improper buffer size calculations. This could be exploited remotely, leading to arbitrary code execution on affected systems. The implications of such exploitation extend to confidentiality, integrity, and availability, allowing attackers to compromise the system's fundamental security guarantees. Ensuring timely updates and patches is critical to safeguard against potential threats.

Affected Version(s)

EDK2 0

References

https://github.com/tianocore/edk2/security/advisories/GHS...

CVSS V4

Score:
9.5
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alex Matrosov (Anthropic)
Dan Holmes-Mitra (Google)
.