TianoCore, which maintains the open-source EDK II code that much UEFI firmware is built from, rates the flaw critical. During PXE boot over IPv4 or IPv6, the PXE Base Code driver (NetworkPkg/UefiPxeBcDxe) copies ICMP error messages into a fixed 504-byte field with broken bounds handling, so a longer message writes attacker-controlled bytes past it. Nothing earlier on the receive path limits the length.

• Who can attack: anyone who can deliver a unicast ICMP error to the client's IP from any network distance, but only during the PXE boot window.
• Impact: at minimum a hung boot. An attacker who knows the firmware build can plant a fake event and have DXE-phase code run their bytes in ring 0, before any OS security control, Secure Boot verification or measured boot.
• Fix: the patch is EDK II PR #13302. The advisory lists no patched release, so the fix reaches servers only as each device maker ships new firmware.
• Credit: Alex Matrosov (Anthropic) and Dan Holmes-Mitra (Google).

What to do: where you don't need network boot, disable PXE in firmware settings. Where you do (provisioning, diskless or recovery boots), keep PXE on an isolated VLAN, filter ICMP errors from outside it, and watch your server vendors' firmware advisories for this CVE.