Researchers from Google and Anthropic reported a serious vulnerability present in the majority of UEFI implementations. The flaw, tracked as CVE-2026-97631, leads to memory corruption and can, under certain conditions, be leveraged for arbitrary code execution.
The vulnerability is restricted to network boot scenarios. During PXE boot the UEFI driver processes ICMP error messages and writes them into a fixed 504-byte buffer. A crafted ICMP packet triggers an out-of-bounds write, allowing malicious code to run with the highest privileges long before the operating system starts. The vulnerable code has been present in TianoCore EDK II for 16 years and is reused by major firmware vendors such as AMI, Insyde, and Phoenix.
Successful exploitation requires the attacker to already be inside the local network and the target system to boot via PXE. Because of the wide variety of UEFI implementations, an attacker must first determine the exact firmware version in use. These constraints make the issue less severe than the earlier PKFail discovery involving default Secure Boot keys.
Other notable developments
At the recent Security Analyst Summit organized by Kaspersky, researchers presented techniques for bypassing isolation in cloud environments and described campaigns that use AI-controlled C2 agents. A separate report detailed a denial-of-service vulnerability in Intelbras IP cameras.
The previous week also saw the compromise of the Binance cryptocurrency exchange, attributed to the theft of an engineer’s laptop. A critical vulnerability named HTTP2Shell (CVE-2026-98432) was found in the Brotli library used by Node.js and the Linux kernel TCP stack. Hardware wallet vendor Trezor was added to the list of supply-chain targets previously affecting Ledger. TeamViewer patched a flaw that can be exploited against the controlling host, and October Android updates addressed a single-message denial-of-service issue. An independent researcher identified 264 malicious Chrome extensions that hijack search traffic, impacting more than 13 million users.
