Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers

A 16-year-old vulnerability has been found in the EDK II code used to build UEFI firmware, which can be exploited to run code before the operating system loads. This is only possible when the machine is booting over a network. The UEFI firmware is the first software to run when a computer is turned on, preceding the operating system. An attacker must be able to reach the machine to potentially exploit this flaw. The vulnerability exists in the open-source code that most hardware manufacturers use to build their UEFI firmware.