2 publishers · first seen Wed, 28 Oct 2026 11:50 UTC · updated Wed, 28 Oct 2026 20:30 UTC
A critical 16-year-old flaw in EDK II, the open-source code used by hardware makers to build UEFI firmware, allows attackers to run code on a machine before its operating system loads during a network boot. The flaw, rated 9.5 out of 10, is a buffer overflow in the PXE network-boot code. An attacker can send a crafted network message during the boot process to hang the boot or, with tailored code, run their own code before Secure Boot and other defenses load. The flaw affects organizations whose machines boot over a network, primarily servers and data center equipment. A code fix exists, but no stable release of EDK II contains it yet.
Content auto-generated. May contain inaccuracies.