Phoenix

Security Week 2645: Critical UEFI Flaw CVE-2026-97631 Enables Remote Code Execution During Network Boot

Researchers from Google and Anthropic disclosed a serious vulnerability in most UEFI implementations that has existed for 16 years. CVE-2026-97631 affects the network boot driver and allows memory corruption when specially crafted ICMP error messages are received during PXE boot. The flaw resides in TianoCore EDK II code used by major vendors including AMI, Insyde, and Phoenix. Exploitation grants arbitrary code execution with maximum privileges before the operating system loads, but only when the system boots over the network. Additional stories from the past week include the Binance exchange breach, a critical Brotli vulnerability, supply-chain compromises affecting Ledger and Trezor hardware wallets, and multiple other high-severity issues across Android, TeamViewer, and browser extensions.