A single ICMP packet during PXE boot runs code before Secure Boot checks anything

On October 22, 2026, TianoCore published an advisory on CVE-2026-97631, a buffer overflow (CVSS 4.0: 9.5) in the EDK II PXE driver that lets a forged ICMP packet execute code at ring 0 before Secure Boot verifies anything. Check your servers’ boot order and disable PXE wherever it is not essential, because no patched firmware has shipped yet.