CVE-2026-97631: 16-Year-Old UEFI Flaw Threatens Servers
CVE-2026-97631: A 16-year-old UEFI flaw (CVSS score of 9.5/10) enables pre-OS code execution. Exposed servers need firmware patches and checks. A critical flaw, tracked as CVE-2026-97631 (CVSS score of 9.5), in the firmware that boots most of the world’s servers is now public, and the patch details came out months early. The bug affects TianoCore […]
Summary from Security Affairs.
Explained
The technology and terms in this story. Learn more
- TechnologyUEFIThe firmware that starts a computer before the operating system loads.
- ConceptCVSS · Common Vulnerability Scoring SystemA 0–10 score for how severe a vulnerability is in theory.
- ConceptCVE · Common Vulnerabilities and ExposuresThe public ID system for vulnerabilities, such as CVE-2026-12345, so everyone means the same bug.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.
- CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')Input is copied into a fixed-size buffer without checking its length, overwriting whatever follows.
- CWE-131Incorrect calculation of buffer size
- CWE-787Out-of-bounds WriteData is written outside the memory it belongs to; the most common root cause of exploited memory bugs.
Vulnerabilities in this story
Severity and exploitation facts from NVD, FIRST, and CISA.