A critical code-execution vulnerability, rated 9.5 out of 10, has been uncovered in boot-time firmware. This flaw exists in TianoCore EDK II, an open-source codebase widely used for UEFI firmware by server vendors and data centers. The vulnerability affects virtually all UEFI suppliers and even Microsoft's Project Mu. Tracked as CVE-2026-97631, it is a memory-corruption flaw in an ICMP component. Attackers can exploit this to execute malicious code before operating system and firmware defenses like Secure Boot are active. Although payloads from this specific exploit lack persistence, they provide an opportunity to install other persistent early boot payloads. The vulnerability was discovered by Alex Matrosov and Dan Holmes, who had planned a coordinated disclosure. However, AMI prematurely published a pull request detailing the vulnerability and its fix. This public disclosure prompted TianoCore to release an advisory. Now, advanced hackers can easily create exploits using the publicly available patch code. Patching this UEFI vulnerability across millions of devices from numerous hardware makers and cloud providers will be a significant and lengthy challenge.