Critical UEFI flaw in EDK II allows pre-boot code execution

# Critical UEFI flaw in EDK II allows pre-boot code execution

https://gcdradar.vercel.app/incidents/critical-uefi-flaw-in-edk-ii-allows-pre-boot-code-execution · AIR-2026-1612 · closed 2026-11-11

- Lane: Patch now
- Severity: 2 (Disclosed vulnerability): Critical rating with researcher disclosure.
- Fix status: Fix status unknown
- First reported: 2026-10-28 (happened 2026-10)
- AI role: No AI role
- Products: EDK II

## Summary

A long-standing critical flaw in EDK II, an open-source UEFI firmware codebase, allows attackers to run code before the operating system loads during network booting. Hardware makers rely on this code to build device firmware.

## What to do

Apply firmware updates provided by your hardware vendor.

## Affected and fixed versions

- Affected: EDK II UEFI firmware

## Latest updates

- 2026-10-28: Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers (https://thehackernews.com/2026/10/critical-16-year-old-uefi-flaw-can-run.html)

## Sources

- 2026-10-28 The Hacker News: Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers https://thehackernews.com/2026/10/critical-16-year-old-uefi-flaw-can-run.html

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.