CVE-2026-97631CWE-120CWE-131CWE-787

CVE-2026-97631

published October 22, 2026

CVSS

9.5

EPSS

—

In the wild

Unconfirmed

What it is

EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds

Write”, Classic

Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability

can lead to arbitrary

code execution. It could also impact

Confidentiality,

Integrity,

and Availability.

The record

Technical detail

CVSS: 9.5 · NONE
CVSS v4.0: 9.5 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS: Not scored
Weaknesses: CWE-120 · Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'); CWE-131 · Incorrect Calculation of Buffer Size; CWE-787 · Out-of-bounds Write
Published: 2026-10-22T21:17Z

References (1)

Timeline