CVE-2026-97631
Publication date 22 October 2026
Last updated 28 October 2026
Ubuntu priority
Description
EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality, Integrity, and Availability.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| edk2 | 26.10 stonking |
Needs evaluation
|
| 26.04 LTS resolute |
Needs evaluation
|
|
| 24.04 LTS noble |
Needs evaluation
|
|
| 22.04 LTS jammy |
Needs evaluation
|
|
| 20.04 LTS focal |
Needs evaluation
|
|
| 18.04 LTS bionic |
Needs evaluation
|
|
| 16.04 LTS xenial |
Needs evaluation
|
|
| edk2-hwe | 26.10 stonking |
Needs evaluation
|
| 26.04 LTS resolute |
Needs evaluation
|
|
| 24.04 LTS noble | Not in release | |
| 22.04 LTS jammy | Not in release |
Severity score breakdown
CVSS version: CVSS v4.0
Base score
9.5 · Critical
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
References
Other references
- https://www.cve.org/CVERecord?id=CVE-2026-97631
- https://github.com/tianocore/edk2/commit/14cdbb86a1a4f9bcce0d6cb78b04af58f226cf48
- https://github.com/tianocore/edk2/commit/560ed9b5b146ed622d7eb7c40254a9099bd65b84
- https://github.com/tianocore/edk2/commit/fa789071ff0b29f1e568bfe153ef7f3d76bd60e4
- https://github.com/tianocore/edk2/pull/13302
- https://github.com/tianocore/edk2/security/advisories/ghsa-99cj-7hg9-mp4m
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1151853