early signals oss-security infra

CVE-2026-97631: Pre-boot RCE in EDK II PXE driver

// AI summary

EDK II PXE driver has a pre-boot Remote Code Execution flaw (CVE-2026-97631) allowing an unauthenticated network attacker to execute code during PXE booting over IPv4 or IPv6.

// from the source

Posted by Valtteri Vuorikoski on Oct 28 Ars Technica reported on this yesterday https://arstechnica.com/security/2026/10/code-execution-flaw-in-uefi-firmware-threatens-most-servers-on-planet-earth/ so let s have it here too. Copied from the advisory https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m on the edk2 repo: Summary While a machine is PXE-booting over IPv4 or IPv6, an unauthenticated network attacker who can deliver ICMP error...
Read at seclists.org ↗ More from oss-security

# more from oss-security

  1. oss-security infra

    CPython [CVE-2026-116566] socket.getaddrinfo() accepts embedded null bytes in host and port

    seclists.org
  2. oss-security

    CVE-2025-60482: GPAC/MP4Box: Heap Use-After-Free in AC-4 Descriptor Cleanup

    seclists.org
  3. oss-security infra

    [OSSA-2026-050] OpenStack keystonemiddleware: access_rules bypass via X-Service-Token (CVE-2026-115642)

    seclists.org
  4. oss-security infra

    [OSSA-2026-049] Ironic: Conductor DoS via gzip bomb configdrive (CVE-2026-115638)

    seclists.org
  5. oss-security infra

    CVE-2026-115942: Apache Qpid Proton C: Verifying non compliant TLS wildcard cert can cause stack buffer overflow read

    seclists.org