{
  "threat_severity" : "Critical",
  "public_date" : "2026-10-22T16:32:27Z",
  "bugzilla" : {
    "description" : "edk2: Pre-boot RCE in EDK II PXE driver",
    "id" : "2559129",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2559129"
  },
  "cvss3" : {
    "cvss3_base_score" : "8.8",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
    "status" : "draft"
  },
  "cwe" : "CWE-787",
  "details" : [ "EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds\nWrite”, Classic\nBuffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability\ncan lead to arbitrary\ncode execution. It could also impact\nConfidentiality,\nIntegrity,\nand Availability.", "A flaw was found in EDK2. Due to improper buffer size calculations in the firmware, an unauthenticated remote attacker can trigger a buffer overflow. Successful exploitation can lead to arbitrary code execution or cause a denial of service (DoS)." ],
  "statement" : "This vulnerability is rated as Critical because an unauthenticated network attacker can execute arbitrary code within the pre-boot firmware execution environment without prior access privileges or user interaction. In Red Hat Enterprise Linux and OpenShift environments, EDK2 provides UEFI firmware for virtualized guests. The vulnerability is exposed exclusively during network boot sequences when the PXE driver processes untrusted network packets before the operating system initializes. Virtual machines booting strictly from local storage or operating in their normal post-boot runtime are not exposed to this flaw.",
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Affected",
    "package_name" : "edk2",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Affected",
    "package_name" : "edk2",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "edk2",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Not affected",
    "package_name" : "openshift/ose-rhel-coreos-8",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 4",
    "fix_state" : "Affected",
    "package_name" : "openshift/ose-rhel-coreos-9",
    "cpe" : "cpe:/a:redhat:openshift:4"
  }, {
    "product_name" : "Red Hat OpenShift Container Platform 5",
    "fix_state" : "Affected",
    "package_name" : "openshift/ose-rhel-coreos-9",
    "cpe" : "cpe:/a:redhat:openshift:5"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-97631\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-97631\nhttps://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m" ],
  "name" : "CVE-2026-97631",
  "csaw" : false
}