Security researchers from Google and Anthropic discovered a security flaw in software used by data centres and server manufacturers. Alex Matrosov of Anthropic and Dan Holmes of Google identified the vulnerability, which is designated as CVE-2026-97631.
The flaw, which is 16 years old, carries a severity rating of 9.5 out of 10. Affected TianoCore EDK II software is utilised by major firmware manufacturers including Phoenix, AMI, and Insyde.
Microsoft’s Project Mu also included the compromised code. Computers and servers using network booting are susceptible to the issue because the software fails to properly check the size of certain network messages.
The problem impacts both IPv4 and IPv6 network connections. Attackers could run malicious code before the operating system and security protections are active.
Laptops or desktop computers started from internal storage drives are not affected by the vulnerability. The TianoCore Project released a public security advisory on 22 October.
Intel stated none of its currently supported commercial products are known to be affected. Arm stated the vulnerability does not directly affect its products.
