全球防御者面临着应对又一个代码执行漏洞的重担，这一次漏洞存在于大多数全球服务器供应商和数据中心使用的启动时固件中。
Defenders across the world face the burden of responding to yet another botched code-execution vulnerability, this time in boot-time firmware used by most of the world’s server vendors and data centers.
该漏洞严重程度评级为 9.5 分（满分 10 分），存在于 TianoCore EDK II 中，这是一个开源代码库，硬件制造商和云服务提供商用它来创建启动序列期间运行的 UEFI 固件。去年，UEFI 论坛的一位代表称 EDK2 为“UEFI 规范的首要解决方案/实现”。几乎所有 UEFI 供应商（有时仍称为 IBV 或独立 BIOS 供应商），包括 AMI、Insyde 和 Phoenix，都广泛使用该参考代码。微软的强化 EDK2 分支 Project Mu 也使用了包含该漏洞组件的代码。
The vulnerability, with a severity rating of 9.5 out of 10, resides in the TianoCore EDK II, an open source codebase that hardware makers and cloud providers use to create the UEFI firmware that runs during the boot-up sequence. Last year, a representative of the UEFI Forum called EDK2 the "preeminent solution / implementation of the UEFI specifications." Virtually all UEFI suppliers (sometimes still called IBVs or independent BIOS vendors), including AMI, Insyde, and Phoenix, use the reference code extensively. Project Mu, Microsoft's hardened EDK2 fork, used the code containing the vulnerable component as well.
该漏洞被追踪为 CVE-2026-97631，是 ICMP 组件中的一个内存损坏缺陷，攻击者可利用它在操作系统和固件实施 Secure Boot 等防御措施之前执行恶意代码，Secure Boot 为启动期间加载的所有代码（包括可信平台模块 TPM）建立信任链。虽然 CVE-2026-97631 交付的最终载荷没有持久性——意味着它们只运行一次——但它们能给攻击者提供一个巨大的窗口，以安装其他同样在启动过程早期每次都运行的载荷。
The vulnerability, tracked as CVE-2026-97631, is a memory-corruption flaw in an ICMP component that attackers can exploit to execute malicious code that runs before the operating system and firmware can implement defenses like Secure Boot, which establishes a chain of trust for all code, including the Trusted Platform Module (TPM), loaded during boot. While final payloads delivered by CVE-2026-97631 have no persistence—meaning they run only once—they can give attackers a wide opening to install other payloads that also run each time early in the boot process.