VSA-2026-059: Out-of-bounds write in the EDK II PXE Base Code driver (CVE-2026-97631 / GHSA-99cj-7hg9-mp4m)
| Published | Updated | Severity | CVSS 4.0 | Affected products |
|---|---|---|---|---|
| 2026-11-10 | 2026-11-10 | 🟠Moderate | 9.5 | - XCP-ng 8.3 |
An out-of-bounds write in the EDK II (edk2) PXE Base Code driver (NetworkPkg/UefiPxeBcDxe) allows an unauthenticated network attacker to execute arbitrary code before the operating system loads, before Secure Boot or measured boot has verified or measured any OS component. For Vates products, we classify the impact as Moderate. For details on how we assign severity levels, see our Severity Levels Explained page.
Summary​
Out-of-bounds write in the EDK II (edk2) PXE Base Code driver (NetworkPkg/UefiPxeBcDxe) that allows an unauthenticated network attacker to execute arbitrary code before the operating system loads, before Secure Boot or measured boot has verified or measured any OS component.
During network boot, the PXE driver keeps a receive request open for ICMP error messages and copies each received message into the fixed 504-byte field Mode.IcmpError of its private context structure. The bounds handling is incorrect in both the IPv4 and IPv6 handlers (PxeBcIcmpErrorDpcHandle and PxeBcIcmp6ErrorDpcHandle): for a message longer than 504 bytes it still copies bytes into the field, and it advances the destination pointer by the cumulative rather than the per-fragment length, so an oversized message writes attacker-controlled bytes past the field. Nothing earlier on the receive path restricts the message length.
Impact​
Exploitation is unauthenticated, pre-boot and over the network, while a machine is PXE-booting over IPv4 or IPv6. The attacker only needs to deliver a unicast ICMP error message addressed to the client's IP, from any network distance, during the PXE boot window. This can (a) deterministically corrupt the driver's private data and raise a CPU exception inside the DXE core on the next ICMP error, hanging the boot (denial of OS provisioning or recovery), or (b) for an attacker who knows the target firmware build, plant a counterfeit event in the same packet and have CoreSignalEvent() dispatch attacker-supplied bytes in the DXE phase (ring 0, before any OS security control exists).
- Only UEFI guests that PXE-boot are exposed.
- Already booted guests are not exposed as this only get exposed during the PXE boot window.
Status​
- Released
Affected Versions​
- XCP-ng 8.3: Affected.
Mitigation​
If PXE network boot is not required, disable it on UEFI guests. Otherwise, there is no known mitigation.
Resolution​
As of 2026-11-10, the edk2 package for XCP-ng 8.3 has been updated to address this issue. The new OVMF firmware applies the next time a VM boots with UEFI firmware.
List of packages fixing this issue:
- XCP-ng 8.3:
edk2-20220801-1.7.13.1.xcpng8.3
Credits​
This issue was discovered by Alex Matrosov (Anthropic) and Dan Holmes-Mitra (Google), who also provided the recommended fix.