| Name | CVE-2026-97631 |
| Description | EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality, Integrity, and Availability. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| edk2 (PTS) | bookworm | 2022.11-6+deb12u2 | vulnerable |
| bookworm (security) | 2022.11-6+deb12u1 | vulnerable | |
| trixie | 2025.02-8+deb13u1 | vulnerable | |
| forky, sid | 2026.08+ds-2 | vulnerable |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| edk2 | source | (unstable) | (unfixed) |
https://github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m
https://github.com/tianocore/edk2/pull/13302
Fixed by: https://github.com/tianocore/edk2/commit/14cdbb86a1a4f9bcce0d6cb78b04af58f226cf48
Fixed by: https://github.com/tianocore/edk2/commit/560ed9b5b146ed622d7eb7c40254a9099bd65b84
Fixed by: https://github.com/tianocore/edk2/commit/fa789071ff0b29f1e568bfe153ef7f3d76bd60e4