ghidra-firmware-utils

Ghidra Firmware Utilities Various modules for Ghidra to assist with PC firmware reverse engineering. This was accepted as a coreboot project for GSoC 2019. Features PCI option ROM loader Implements a FS loader for PCI option ROMs handles hybrid ROMs with multiple images, e.g. legacy x86 + UEFI...

uefi-pxe-cve-2026-97631

uefi-pxe-cve-2026-97631 — headless harness for the EDK II PXE ICMP overflow ⚠️ LOCAL LAB ONLY. These tools drive a local QEMU VM against a firmware you control. Never point the ICMP generator at hardware or networks you don't own. CVE-2026-97631: a 16-year-old buffer overflow in TianoCore EDK II...

CVE-2026-97631-PoC

EDK II PXE Security Lab — CVE-2026-97631 An educational laboratory for studying a PXE network-boot vulnerability in EDK II / OVMF. It builds a pinned EDK II revision, boots a UEFI virtual machine in QEMU, and includes Python proof-of-concept scripts for investigating denial of service DoS and...

Bootjack

CVE-2026-97631: pre-boot DXE memory reader Tooling for the EDK II PXE Base Code driver ICMP error overflow NetworkPkg/UefiPxeBcDxe, GHSA-99cj-7hg9-mp4m, CVSS 4.0 9.5. During a PXE boot the driver copies an ICMP error message into a fixed 504-byte buffer. A longer message becomes a linear write pa...

Barzakh

Project Barzakh برزخ "Barzakh" برزخ — a barrier between two realms; the unseen boundary separating the living world from the world of spirits. Here it stands for the barrier between offense and defense, between vulnerability and detection. The most comprehensive open-source UEFI firmware security...

edk2 security update

An update is available for edk2. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list EDK Embedded Development Kit is a project to enable UEFI support for Virtual...

EDK II Mitigations for Transient Scheduler Attacks (TSA)

CVE Details Refer to Glossary for explanation of terms CVE| CVE Description| CVSS Base Score ---|---|--- CVE-2026-18448 non-AMD| Insufficient Transient Scheduler Attack TSA mitigations in EDK II could allow a ring-0 attacker to infer residual microarchitectural state left by SMM execution,...

AlmaLinux 10 : edk2 (ALSA-2026:96240)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:96240 advisory. edk2: Pre-boot RCE in EDK II PXE driver CVE-2026-97631 Tenable has extracted the preceding description block directly from the AlmaLinux security advisory. Note...

RockyLinux 10 : edk2 (RLSA-2026:96240)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:96240 advisory. edk2: Pre-boot RCE in EDK II PXE driver CVE-2026-97631 Tenable has extracted the preceding description block directly from the RockyLinux security advisory. Not...

IOMMU Improper Exception Handling and SMM Out-of-Bounds Write Vulnerabilities

CVE Details Refer to Glossary for explanation of terms CVE| CVE Description| CVSS Score ---|---|--- CVE-2026-14968 non-AMD| An out-of-bounds write in TianoCore EDK II’s UefiCpuPkg MmSaveStateReadRegisterByIndex AmdMmSaveState.c allows a local attacker with SMM privileges on AMD platforms where...

Critical: Red Hat Security Advisory: edk2 security update

An update for edk2 is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

Pre-boot RCE in EDK II PXE Driver

CVE Details Refer to Glossary for explanation of terms CVE| CVE Description ---|--- CVE-2026-97631 non-AMD| https://vulners.com/cve/CVE-2026-97631...

CLEANSTART-2026-NQ21805 Missing cryptographic key commitment in the AWS SDK for PHP may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data k...

Security vulnerability affects the nextcloud package. Missing cryptographic key commitment in the AWS SDK for PHP may allow a user with write access to the S3 bucket to introduce a new EDK that decrypts to different plaintext when the encrypted data key is stored in an "instruction file" instead ...

Exploit for CVE-2026-97631

EDK II PXE Security Lab — CVE-2026-97631 An educational labor...

EDK II Master PXE ICMP Error Buffer Overflow

EDK II master version as of 2026-09-14 contains an ICMP error handling buffer overflow in its PXE driver. This submission provides denial of service and experimental remote code execution proof of concept scripts for an isolated QEMU PXE environment. https://packetstorm.news/download/238180...

TianoCore EDK II PXE ICMP Error Buffer Overflow

TianoCore EDK II contains a buffer overflow in UefiPxeBcDxe ICMP error handling. This proof of concept harness sends oversized ICMP error packets during PXE boot against a local QEMU/OVMF lab. https://packetstorm.news/download/238194...

Exploit for CVE-2026-97631

PXE Zero Working lab exploit and business pack for CVE-2026-9...

Exploit for CVE-2026-97631

uefi-pxe-cve-2026-97631 — headless harness for the EDK II PXE...

Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers

A critical 16-year-old flaw in EDK II , the open-source code that most hardware makers use to build UEFI firmware, can allow an attacker to run code on a machine before its operating system loads, but only while the machine is booting over the network. UEFI firmware is the software that runs firs...

CVE-2026-97631 Pre-boot RCE in EDK II PXE driver

EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality,...