CVE-2026-97631 does not affect home and small business users, or any other users who boot their device only from disk drives. Instead, it only applies to organizations whose machines boot from local networks, or possibly from resources connected to the Internet. Even then, the targeted firmware must rely on EDK2, as opposed to a different reference implementation, and use PXE functionality (which is enabled by default).
In an email, Intel said none of its “currently supported commercial products” were known to be affected. “Intel does not include the affected EDK2 functionality in its reference code, although it may be integrated by an OEM board vendor or system manufacturer,” the company added. He advised customers to check with their system manufacturer for specific advice. The publicly available Intel reference code, however, refers to EDK2. Additionally, TianoCore said that each UEFI development kit provided by Intel “is a fully validated implementation…for a specific revision of the EDK II source.” Many other Intel documents also refer to EDK2.
Arm, meanwhile, responded to a list of questions with: “CVE-2026-97631 is not directly applicable to Arm’s product portfolio. » Like Intel, the firmware offered by the company also borrows heavily from EDK2. TianoCore also documented Arm’s reliance on EDK2.
Although it is possible that some platforms are free of EDK2 code, it is prudent for users of all servers to check whether CVE-2026-97631 affects them.
Questions sent to AMD, Phoenix Technologies, AMI, Microsoft, and Amazon (likely some of the other larger organizations involved) remained unanswered when this post was published. Without concrete answers to questions about the use of EDK2 by organizations like these, it is impossible to say which or how devices are affected and what actions, if any, these organizations or their users should take. Representatives of the TianoCore project also did not respond.
Gn tech
