UEFI firmware code-execution flaw affects most servers
The gist
A 16-year-old buffer overflow in TianoCore EDK II is rated 9.5 out of 10 severity.
Patch code was public months early, letting advanced attackers study how to trigger it.
How it unfolded
- 2025A UEFI Forum representative called EDK2 the preeminent implementation of the UEFI specifications.
- Sep 2026AMI published a pull request (tianocore/edk2/pull/13200) detailing the vulnerability and including a code fix.
- Oct 21, 2026TianoCore Project members published a public advisory (GHSA-99cj-7hg9-mp4m) after the AMI post came to the discovering parties' attention.