Overview of CVE-2026-97631

CVE-2026-97631 is a vulnerability primarily affecting organizations that utilize devices booting from local networks or internet-based resources. This issue does not pertain to home or small office users, as they typically boot their devices directly from disk drives. To be specifically vulnerable, a system’s firmware must be based on the EDK2 platform and employ PXE functionality, which is commonly activated by default.

Responses from Key Manufacturers

Intel’s Position

According to Intel, none of its “commercial products currently under security support” are known to be impacted by this vulnerability. The company clarifies that the EDK2 functionality at risk is not present in its reference code. However, it acknowledges that system manufacturers or OEM vendors may implement this functionality. Customers are advised to consult their system manufacturers for tailored guidance.

Publicly accessible Intel reference code does mention EDK2, and Intel’s UEFI development kits are validated for specific revisions of the EDK II source code. Many Intel documents continue to reference EDK2 accordingly.

Arm’s Clarification

In response to inquiries about CVE-2026-97631, Arm indicated that this vulnerability does not directly apply to its product offerings. Nevertheless, like Intel, Arm’s firmware heavily integrates EDK2 components, as noted by TianoCore documentation.

Best Practices for Affected Users

Although some platforms may not incorporate EDK2 code, it is strongly recommended that users investigate whether CVE-2026-97631 affects their systems, particularly those managing servers.

Unanswered Inquiries

At the time of this article, questions were sent to several prominent companies, including AMD, Phoenix Technologies, AMI, Microsoft, and Amazon, regarding their potential vulnerability to CVE-2026-97631. Unfortunately, responses were not received, leaving uncertainty about the implications of EDK2 usage in their firmware.

Without definitive answers, it remains unclear how entities using these technologies might be affected and what actions they should consider taking. The TianoCore Project, an important player in this domain, also did not provide a response.