EDK II PXE boot flaw could allow code execution before the operating system loads

TianoCore warns that CVE-2026-97631 could let an attacker run code before the operating system loads on affected EDK II systems during PXE boot. Ars Technica says systems booting solely from disk are unaffected, and an exploit must be tuned to the target firmware. The advisory links a patch pull request but lists patched versions as “Not patched currently.” Ars advises potentially affected organizations to ask their firmware maker for guidance.