ipxe

iPXE network bootloader iPXE is the leading open source network boot firmware. It provides a full PXE implementation enhanced with additional features such as: boot from a web server via HTTP or HTTPS, boot from an iSCSI, FCoE, or AoE SAN, control the boot process with a script, create interactiv...

PXEThief

PXEThief PXEThief is a set of tooling that implements attack paths discussed at the DEF CON 30 talk Pulling Passwords out of Configuration Manager https://forum.defcon.org/node/241925 against the Operating System Deployment functionality in Microsoft Endpoint Configuration Manager or ConfigMgr,...

uefi-pxe-cve-2026-97631

uefi-pxe-cve-2026-97631 — headless harness for the EDK II PXE ICMP overflow ⚠️ LOCAL LAB ONLY. These tools drive a local QEMU VM against a firmware you control. Never point the ICMP generator at hardware or networks you don't own. CVE-2026-97631: a 16-year-old buffer overflow in TianoCore EDK II...

CVE-2026-97631-PoC

EDK II PXE Security Lab — CVE-2026-97631 An educational laboratory for studying a PXE network-boot vulnerability in EDK II / OVMF. It builds a pinned EDK II revision, boots a UEFI virtual machine in QEMU, and includes Python proof-of-concept scripts for investigating denial of service DoS and...

Bootjack

CVE-2026-97631: pre-boot DXE memory reader Tooling for the EDK II PXE Base Code driver ICMP error overflow NetworkPkg/UefiPxeBcDxe, GHSA-99cj-7hg9-mp4m, CVSS 4.0 9.5. During a PXE boot the driver copies an ICMP error message into a fixed 504-byte buffer. A longer message becomes a linear write pa...

bitlocker-bypass-research

BitLocker Bypass Research Personal security research project — bypassing BitLocker full disk encryption using CVE-2023-21563 BitPixie. What This Is In October 2025, I did a physical laptop recovery assessment on a corporate laptop with BitLocker enabled. The employee forgot their password and the...

Rocky Linux 10.2 [CIQ] Security Update: edk2-aarch64 / edk2-debugsource / edk2-ovmf / edk2-tools / etc (crlsa-2026_96240)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202696240 advisory. edk2: Pre-boot RCE in EDK II PXE driver CVE-2026-97631 Tenable has extracted the preceding description block directly from the CIQ security advisory. Note that...

RLSA-2026:96240 Critical: edk2 security update

EDK Embedded Development Kit is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. Security Fixes: edk2: Pre-boot RCE in EDK II PXE driver CVE-2026-97631 For more details about the security issues, including the impact, a...

edk2 security update

An update is available for edk2. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list EDK Embedded Development Kit is a project to enable UEFI support for Virtual...

AlmaLinux 10 : edk2 (ALSA-2026:96240)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:96240 advisory. edk2: Pre-boot RCE in EDK II PXE driver CVE-2026-97631 Tenable has extracted the preceding description block directly from the AlmaLinux security advisory. Note...

RockyLinux 10 : edk2 (RLSA-2026:96240)

The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:96240 advisory. edk2: Pre-boot RCE in EDK II PXE driver CVE-2026-97631 Tenable has extracted the preceding description block directly from the RockyLinux security advisory. Not...

Critical: Red Hat Security Advisory: edk2 security update

An update for edk2 is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

edk2: Pre-boot RCE in EDK II PXE driver

A flaw was found in EDK2. Due to improper buffer size calculations in the firmware, an unauthenticated remote attacker can trigger a buffer overflow. Successful exploitation can lead to arbitrary code execution or cause a denial of service DoS...

edk2 security update

20251114-5.0.1.el102.3 - Replace upstream references Orabug:36569119 20251114-5.el102.3 - edk2-NetworkPkg-UefiPxeBcDxe-Fix-ICMP-buffer-overflow-in-.patch RHEL-291254 - Resolves: RHEL-291254 CVE-2026-97631 edk2: Pre-boot RCE in EDK II PXE driver rhel-10.2.z...

RHEL 10 : edk2 (RHSA-2026:96240)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:96240 advisory. EDK Embedded Development Kit is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU...

XenServer Security Update for Multiple Issues

Severity: Critical Description of Problem An issue has been identified that may allow an unauthenticated attacker on the management network to compromise the hostand/or any running Workload Balancing WLB or Conversion Manager appliances. This issue has the following identifier: CVE-2026-98432 A...

Pre-boot RCE in EDK II PXE Driver

CVE Details Refer to Glossary for explanation of terms CVE| CVE Description ---|--- CVE-2026-97631 non-AMD| https://vulners.com/cve/CVE-2026-97631...

SUSE CVE-2026-93006

A flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a recently used transfer cache is not invalidated when a transfer finishes. An attacker on the local network who can request a TFTP file may cause a later client to receive previously cached data instead of the...

CVE-2026-93006

A flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a recently used transfer cache is not invalidated when a transfer finishes. An attacker on the local network who can request a TFTP file may cause a later client to receive previously cached data instead of the...

AZL-112415 CVE-2026-93006 affecting package dnsmasq 2.93-1

A flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a recently used transfer cache is not invalidated when a transfer finishes. An attacker on the local network who can request a TFTP file may cause a later client to receive previously cached data instead of the...