United StatesA 16-year-old bug runs attacker code before Secure Boot loads.

Virtually every server firmware maker, including AMI, Insyde and Phoenix, builds on the flawed code.

The 9.5-rated bug overflows a 504-byte buffer in the network-boot driver when an oversized error message arrives.

Attackers must already be on the network, and Eclypsium’s Jesse Michael says each exploit needs tuning per firmware build.

The fix is public, but AMD, Microsoft and Amazon did not answer questions about their exposure.

How each outlet framed it
Ars Technica leans critical
frames the CVE-2026-97631 EDK2 flaw as hitting pre-OS boot code that precedes Secure Boot, and notes Microsoft's Project Mu fork inherited it

Sources: Ars Technica