CVE-2026-97631

Deferred Deferred - Pending Action

EDK2 BIOS Out-of-Bounds Write Vulnerability

Publication date: 2026-10-22

Last updated on: 2026-10-30

Assigner: TianoCore.org

Description

EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality, Integrity, and Availability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-22

Last Modified

2026-10-30

Generated

2026-11-02

AI Q&A

2026-10-23

EPSS Evaluated

2026-11-01

NVD

CVE-2026-97631

Affected Vendors & Products

Vendor	Product	Version / Range
TianoCore	EDK2	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.
CWE-120	The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.
CWE-131	The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.

Attack-Flow Graph

Executive Summary

This vulnerability in EDK2 BIOS allows remote users to trigger out-of-bounds writes, buffer overflows, and incorrect buffer size calculations. Exploitation could lead to arbitrary code execution and impact system confidentiality, integrity, and availability.

Detection Guidance

Detection of this vulnerability requires checking for outdated or vulnerable versions of EDK2 BIOS firmware. Inspect firmware versions using system management tools or BIOS update utilities. Monitor for unusual behavior like unexpected code execution or memory corruption.

Impact Analysis

Successful exploitation may allow attackers to execute arbitrary code on affected systems, potentially leading to data breaches, system crashes, or unauthorized access. This could compromise sensitive information or disrupt operations.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating confidentiality and integrity requirements in GDPR and HIPAA. Non-compliance risks include legal penalties, fines, and reputational damage.

Mitigation Strategies

Apply the latest security patches or updates provided by TianoCore EDK2 for BIOS firmware. Monitor vendor advisories for BIOS updates addressing buffer overflow issues. Disable unnecessary remote access features if possible. Implement network segmentation to limit exposure of vulnerable systems.

Hi! I’m here to help you understand CVE-2026-97631. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...