Vulnerability found in UEFI firmware

A critical vulnerability has been identified in UEFI, a firmware used in many computing devices, including Mac Intel computers, most PCs, and some ARM-based machines. The flaw, known as CVE-2026-97631, has a severity rating of 9.5 out of 10, indicating it could pose significant risks if exploited, although the actual risk is considered low due to the specific conditions needed for an attack.

UEFI's role in computing

UEFI is responsible for initializing hardware and loading the operating system during the boot process. It replaces the older BIOS and offers more advanced features, such as displaying images, loading drivers, and providing network access. The vulnerability occurs during the network booting (PXE) process, which is used to retrieve system installation files from a server.

Nature of the vulnerability

The vulnerability arises from a buffer overflow in the UEFI's error message handling. The UEFI reserves only 504 bytes for error messages, and if a server sends more data, it can cause a buffer overflow. This could allow an attacker to execute code before the operating system starts, potentially installing malicious software that persists even after the system reboots.

Mitigating factors

Several factors reduce the risk of exploitation. Network booting is not common in many environments, and servers that use PXE booting typically do not restart frequently. The attack also requires the attacker to control the PXE server, which implies a local compromise. Additionally, the vulnerability needs specific adaptations for different server types and hardware configurations, making exploitation more complex.

Challenges in addressing the flaw

Fixing the vulnerability is complicated. Each server requires identifying the motherboard manufacturer, UEFI version, and supplier to find an available update. Updating UEFI is not as simple as updating an operating system and often requires shutting down the server for several minutes, which may not be practical in some settings. Firmware updates also carry risks, as errors can render hardware unusable.

UEFI development and implications

Apple uses a slightly different firmware called EFI, but the underlying principles are similar. UEFI is typically developed by a few suppliers, such as AMI, Insyde, and Phoenix, who base their work on the EDK II code, an open-source project. The vulnerability is located in this code, underscoring the complexity of managing firmware across a wide range of hardware platforms.