TianoCore published GitHub advisory GHSA-99cj-7hg9-mp4m, "Pre-boot RCE in EDK II PXE driver", on 22 October 2026, rated Critical (CVSS 4.0 9.5, CWE-120).

According to the advisory, the UefiPxeBcDxe driver in NetworkPkg copies ICMP error packets into the 504-byte Mode.IcmpError field in both its IPv4 and IPv6 handlers, so an unauthenticated attacker can send a unicast ICMP error during PXE boot from any network distance. Results range from a boot hang to code execution in DXE at ring 0 when the attacker knows the firmware build.

The advisory lists EDK II master as of 2026-09-14 as affected, says it is "Not patched currently" and points to fix pull request 13302; the CVE record lists versions up to edk2-stable202608. Credit goes to Alex Matrosov (Anthropic) and Dan Holmes-Mitra (Google).

Ars Technica (27 Oct) reports that disclosure went wrong after an AMI pull request last month, with coordinated disclosure originally planned for January; that Intel says no commercial products under security support are known to be affected; that Arm says the issue is not directly applicable; and that Eclypsium's Jesse Michael says exploits must be tuned per target.

Ars says home computers that boot from disk are not affected.