Skip to content
OpenAdvisories
High ALAS2-2026-4047 1 CVE

Important: edk2 security update (Amazon Linux 2)

Published Nov 2, 2026 · Updated Nov 2, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-97631: EDK2 contains a vulnerability in BIOS where a user may cause "Out-of-bounds Write", Classic Buffer Overflow, and "Incorrect Calculation of Buffer Size" by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It could also impact Confidentiality, Integrity, and Availability.

Fixed packages 5

ReleasePackageFixed in
Amazon Linux · 2 edk2-aarch64 0:20240813-315.amzn2
Amazon Linux · 2 edk2-debuginfo 0:20240813-315.amzn2
Amazon Linux · 2 edk2-ovmf 0:20240813-315.amzn2
Amazon Linux · 2 edk2-tools 0:20240813-315.amzn2
Amazon Linux · 2 edk2-tools-doc 0:20240813-315.amzn2

Vulnerabilities 1

  • Critical 9.5
    CVE-2026-97631 Public exploit

    Pre-boot RCE in EDK II PXE driver

    EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and “Incorrect Calculation of Buffer Size” by remote access. Successful exploitation of this vulnerability can lead to arbitrary code execution. It co…

    TianoCore EDK2 edk2 qemu Debian Ubuntu Azure Linux

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-97631.html