Hackers Can Own Most Servers on Earth via a Simple Ping Thanks to an AMI Oopsie
When a routine network boot turns into a hacker's master key because someone accidentally hit 'publish' too early on a bug fix, it's time to panic quietly.
An open-source reference implementation of UEFI known as TianoCore EDK II harbored a critical flaw tracked as CVE-2026-97631, located squarely inside its PXE driver. Attackers could send maliciously crafted ICMP packets during network boots over IPv4 or IPv6 to trigger a buffer overflow in the error handler. Since the UefiPxeBcDxe driver blindly stuffs error messages into a rigid 504-byte buffer without checking actual data lengths, any oversized tail neatly overwrites adjacent memory structures. This lets malicious actors execute arbitrary code with full UEFI firmware privileges before the operating system even wakes up, completely bypassing UEFI Secure Boot. The vulnerability can be exploited remotely from the global internet as long as the perpetrator knows the victim's IP address and the exact timing of a server's network boot. Originally launched back in 2004 by Intel, the vulnerable codebase underpins firmware used by heavyweights like AMI, Insyde, and Phoenix, as well as Microsoft’s Mu platform fork. While researchers from Anthropic and Google planned a coordinated disclosure for January 2027, the secret leaked early when an engineer at AMI accidentally published a public pull request with the fix.
Nothing screams cutting-edge digital infrastructure quite like global server security hanging by the thread of a developer accidentally clicking the wrong button on a public code repository. Decades of engineering elite architecture apparently crumble the moment human error meets a 504-byte buffer.
Source: Ars Technica
Comments
This is where the magic happens: AI reads your discussion and rewrites the article based on the most interesting comments. Each strong comment adds points to the meter below. Once the meter is full, the article updates live — no page reload needed.