Code-execution flaw in UEFI firmware affects most servers on planet Earth
Comments on “Code-execution flaw in UEFI firmware affects most servers on planet Earth”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
A buffer overflow in the PXE Base Code driver of TianoCore EDK II, tracked as CVE-2026-97631 and reportedly rated 9.5 of 10, lets an attacker with local network access run code before Secure Boot and TPM protections apply. Details leaked through a public AMI patch ahead of a planned January disclosure. Exploits need tuning per firmware build, and only network-booting systems are exposed. Builders should ask firmware vendors for guidance and consider disabling network boot. Most claims are unverified, and several vendors have not responded.
Why it ranked
No. 6 of 155 with a score of 0.72. The panel rated it highest on new information (0.91) and reader interest (0.88), lowest on substantiated (0.71). Overclaim counted against it (0.62). The judges disagreed most on overclaim (spread 0.57), so the story is marked contested.
- AI judgeJudge 2claude-haiku-5-5
- Major pre-boot code-execution flaw in widely used EDK2 firmware; well sourced with advisory and patch details, though exploit specifics and vendor responses are missing, and it is largely a news report.
- AI judgeJudge 3gpt-5.6-luna
- A technically detailed report on a serious, ecosystem-wide UEFI vulnerability with concrete exploitation constraints and mitigation guidance. Its headline overstates ubiquity and impact relative to the article’s caveats and lack of confirmed exploitation.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.72total under rubric v2.2Contestedjudges differ by 0.57 on overclaim
- Significance0.76
- Reader interest0.88
- Audience breadth0.77
- Practical relevance0.75
- Substantiated0.71
- Technical depth0.80
- New information0.91
- Counts against: Promotional0.03
- Counts against: Overclaim0.62
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| Significance | 0.74 | 0.72 | 0.82 | 0.76 | 0.10 | +0.24 | +0.183 |
| Reader interest | 0.79 | 0.90 | 0.95 | 0.88 | 0.16 | +0.26 | +0.229 |
| Audience breadth | 0.85 | 0.75 | 0.72 | 0.77 | 0.13 | +0.13 | +0.101 |
| Practical relevance | 0.67 | 0.80 | 0.78 | 0.75 | 0.13 | +0.22 | +0.165 |
| Substantiated | 0.57 | 0.80 | 0.76 | 0.71 | 0.23 | +0.05 | +0.035 |
| Technical depth | 0.83 | 0.80 | 0.78 | 0.80 | 0.05 | +0.05 | +0.040 |
| New information | 0.90 | 0.85 | 0.98 | 0.91 | 0.13 | +0.05 | +0.046 |
| Promotional | 0.05 | 0.03 | 0.02 | 0.03 | 0.03 | −0.19 | −0.006 |
| Overclaim | 0.79 | 0.25 | 0.82 | 0.62 | 0.57 , above the contested threshold | −0.11 | −0.068 |
| Sum of contributions | +0.724 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.724 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-10-28/6/"><img src="https://rubric.hrih.si/badge/2026-10-28/6.svg" alt="Ranked #6 on Rubric, 28 Oct 2026" width="238" height="28"></a>Claim check
Claim check: 4 no source given · 4 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
No source givenNumber
CVE-2026-97631 in TianoCore EDK II has a severity rating of 9.5 out of 10.
The article gives no link or citation for it.
The article says “The vulnerability, with a severity rating of 9.5 out of 10, resides in the TianoCore”
The source says No source to compare with.
Couldn’t checkQuote
A representative of the UEFI Forum called EDK2 the "preeminent solution / implementation of the UEFI specifications."
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “preeminent solution / implementation of the UEFI specifications”
The source says No passage could be compared.
Source cited by the article: uefi.org/sites/default/files/resources/State%20of%20UEFI_UEFI%202025%20DevCon_Final.pdf
Couldn’t checkNumber
CVE-2026-97631 is a 16-year-old buffer overflow in the PXE-Base Code driver (NetworkPkg/UefiPxeBcDxe) caused by the driver not enforcing a 504-byte memory copy limit.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “CVE-2026-97631 is a 16-year-old buffer overflow in the PXE-Base Code driver (NetworkPkg/UefiPxeBcDxe”
The source says No passage could be compared.
Source cited by the article: github.com/tianocore/edk2/security/advisories/GHSA-99cj-7hg9-mp4m
Couldn’t checkDate
AMI published a pull request last month that detailed the vulnerability and included a code fix, breaking the coordinated disclosure scheduled for January, and TianoCore then published a public advisory.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “AMI, a maker of motherboards and other hardware, published this pull request last month that detailed the vulnerability and included a code fix”
The source says No passage could be compared.
Source cited by the article: github.com/tianocore/edk2/pull/13200
No source givenNumber
The vulnerability was discovered by Alex Matrosov of Anthropic and Dan Holmes of Google.
The article gives no link or citation for it.
The article says “The parties that discovered CVE-2026-97631—Alex Matrosov of Anthropic and Dan Holmes of Google—had arranged for it to stay under wraps”
The source says No source to compare with.
No source givenQuote
Intel said none of its commercial products currently under security support are known to be affected, since it does not include the affected EDK2 functionality in its reference code.
The article gives no link or citation for it.
The article says “none of its “commercial products currently under security support” are known to be affected”
The source says No source to compare with.
Couldn’t checkGeneralization
PixieFail was a similar vulnerability resulting from faulty PXE boot flaws in EDK2.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “PixieFail was a vulnerability similar to CVE-2026-97631. It, too, was the result of faulty PXE boot flaws in EDK2”
The source says No passage could be compared.
Source cited by the article: arstechnica.com/security/2024/01/new-uefi-vulnerabilities-send-firmware-devs-across-an-entire-ecosystem-scrambling
No source givenQuote
Unlike BootHole, Black Lotus and Baton Drop, this vulnerability can be fixed with a basic code fix deployed via a BIOS/UEFI update, without revocations or key management updates.
The article gives no link or citation for it.
The article says “this vulnerability can be fixed with a basic code fix, which will require deploying a BIOS/UEFI update”
The source says No source to compare with.
Also covered by
Elsewhere
Elsewhere: HN 96 pts, front page
Recorded for context only, checked 28 Oct 2026, 06:47 UTC. It played no part in the ranking.