Security researchers from Google and Anthropic have uncovered serious server security vulnerabilities in widely used boot firmware, allowing attackers to run malicious code before Windows or Linux even starts. The issue, tracked as CVE-2026-97631, is about 16 years old and carries a severity score of 9.5 out of 10. It sits in TianoCore EDK II, software that helps machines start up and is used by major firmware makers including AMI, Insyde, and Phoenix; Microsoft’s Project Mu has also included the affected code.
How the flaw works
The problem shows up on computers and servers that can start from files downloaded over a network rather than from their own storage. That practice, called network booting, is common in businesses and data centres that manage many machines at once. Researchers found that the software does not properly check the size of certain network messages. An attacker on the network could send a specially crafted message with more data than the software can safely handle, which might freeze the machine during startup or let malicious code run. The issue affects both IPv4 and IPv6 connections.
The main worry is timing. An exploit could run before the operating system and its security tools are fully active, which could give an attacker high-level control. Security expert HD Moore has warned that, under certain conditions, attackers might reach sensitive security components and weaken disk encryption. Malware installed this way could also survive a restart. Attackers would generally need access to the target network, and attacks would need to be tuned for different hardware and software versions. There is no evidence so far that the flaw lets outsiders break into a protected network from outside.
Who is affected — and who is not
Everyday laptop and desktop users who boot from their internal drives are not exposed to this particular attack path. The main risk is to organisations that use network booting on servers, storage gear, and similar devices — and only if their firmware includes the affected component. These server security vulnerabilities therefore matter most for IT teams that manage fleets of machines, not for someone turning on a home PC from its hard disk.
Intel said none of its currently supported commercial products are known to be affected, but advised customers to check with device makers. Arm said the flaw does not directly affect its products. At the time of the original public discussion, AMD, Microsoft, Amazon, AMI, and Phoenix Technologies had not given clear answers about possible exposure. The full list of affected devices remains unclear.
Timeline: what has happened so far
- Planned for January: Alex Matrosov of Anthropic and Dan Holmes of Google had aimed to disclose the issue publicly in January so manufacturers could prepare updates.
- Early manufacturer notice: Hardware maker AMI published information about the vulnerability and a proposed fix ahead of that schedule.
- 22 October 2026: The TianoCore Project released a public security advisory after the early disclosure.
The early release raised concern that attackers could study the details before devices receive patches. Fixes may also take time because many manufacturers embed the same software in different products. Similar past problems in boot software — including LogoFail, PixieFail, PKFail, BootHole, and the BlackLotus bootkit — have shown how dangerous pre-OS attacks can be. Experts warn the latest flaw could linger for years on older servers that no longer get updates.
What organisations should do next
Security specialists say businesses should check whether their servers and other equipment use the affected software, then contact hardware manufacturers about vulnerability status and available updates. If network booting is not required, temporarily turning it off reduces exposure. Keeping existing security protections on and watching networks for odd activity helps, though those steps cannot fully block this class of flaw. For now, the hard part is finding every affected device and installing fixes before attackers can use the published details.
Aasan alfaaz mein
Google aur Anthropic ke researchers ne servers ke start hone wale software mein bohot serious khami pakri hai. Yeh attack Windows ya Linux chalney se pehle ho sakta hai, lekin aksar un systems par jahan network se boot hota hai. Ghar ke normal laptop/desktop jo apni hard disk se start hote hain, is khas tariqe se khatre mein nahi. Companies ko apne manufacturers se update poochna chahiye aur agar network boot zaroori na ho to band kar dena behtar hai.
