A firmware update is the process of replacing the low-level code stored in non-volatile flash memory of a computer or one of its components, such as the UEFI system firmware, an SSD controller or a network adapter, with a newer, usually cryptographically signed version. Operating systems depend on this code before and during boot, so in the boot & firmware layer an update changes behavior that runs before the operating system starts and that the operating system cannot easily override.
Firmware updates fix bugs, close security vulnerabilities, add hardware support and update CPU microcode. Because a failed update can leave a device unable to start, the process is built around validation, redundancy and recovery rather than speed.
How a firmware update is delivered and applied
Modern PCs use the UEFI capsule update mechanism. The operating system or an update tool stages a firmware capsule (an image with a header and signature) and asks the firmware to process it at the next restart. During that restart, before any operating system code runs, the firmware verifies the signature, writes the new image to the SPI flash chip and reboots into the new version.
The steps below are typical for system firmware; device firmware follows a similar pattern through the device’s own controller.
| Stage | What happens | Main risk |
|---|---|---|
| Staging | The capsule is placed on the EFI system partition or in memory | Corrupted download |
| Verification | Signature and version are checked against firmware policy | Rejected or mismatched image |
| Flashing | New code is written to SPI flash regions | Power loss mid-write |
| Activation | System reboots into the new firmware | Incompatible settings or drivers |
| Reporting | Firmware records success or failure for the OS | Silent partial update |
On Linux, fwupd with the Linux Vendor Firmware Service delivers capsules and device firmware; Windows distributes many firmware packages through Windows Update as driver-like capsule packages. Vendor flashing utilities and firmware setup flash tools remain common for manual updates.
Types of firmware that receive updates
A single PC contains dozens of separate firmware images. Each has its own update path, version numbering and failure consequences, which is why a fully patched operating system does not imply fully patched firmware.
| Component | Typical update path | Why updates matter |
|---|---|---|
| UEFI or BIOS system firmware | Capsule, vendor tool or setup utility | Security fixes, hardware support, stability |
| CPU microcode | Firmware update or early OS loading | Processor errata and side-channel mitigations |
| Management engine firmware | Bundled with system firmware updates | Fixes in a highly privileged subsystem |
| SSD controller firmware | Vendor tool or fwupd | Data integrity, performance, endurance |
| Embedded controller | Bundled with system firmware | Battery, fan and keyboard behavior |
| Peripheral and dock firmware | Vendor tool or OS update service | Compatibility and Thunderbolt security |
CPU microcode is a special case: the operating system can load a newer microcode patch at every boot without changing flash, but that patch is volatile and disappears at power-off, while a firmware update makes it permanent.
Security protections around firmware updates
Firmware runs with the highest privilege on the platform, so a malicious update could survive disk wipes and operating system reinstallation. Platforms defend the update path with several layers, many of which follow the platform firmware resiliency principles of protection, detection and recovery.
| Protection | What it prevents | How it works |
|---|---|---|
| Signed updates | Installation of tampered images | Firmware accepts only vendor-signed capsules |
| Rollback protection | Downgrade to a vulnerable version | Security version numbers block older images |
| Flash write protection | Direct writes from the operating system | Flash regions locked after early boot |
| Hardware root of trust | Execution of modified boot code | Boot Guard or similar verifies firmware at reset |
| Redundant images | A permanently unbootable device | Backup or A/B copy restores working firmware |
Firmware updates interact with Secure Boot and measured boot. Because the firmware measurements recorded in the TPM change after an update, disk encryption that is sealed to those measurements, such as BitLocker, may ask for its recovery key unless protection is suspended before the update.
Firmware update compared with related updates
A firmware update differs from a driver update, which changes operating system code that talks to hardware, and from an operating system update, which changes files on disk. Firmware lives on the device itself, so it persists across disks and operating systems, and a bad image can affect every operating system installed on that machine.
This persistence also explains why firmware updates are released less often and tested more conservatively. A typical business PC receives a few system firmware releases per year, while drivers and operating system patches arrive far more frequently.
Practical guidance and common failure causes
Most failed updates trace back to interrupted power, the wrong image for the hardware revision or settings that no longer match the new firmware. Following a disciplined procedure removes most of that risk.
- Connect AC power and keep the battery above the vendor minimum, often around 20 to 30 percent.
- Suspend disk encryption protection or confirm the recovery key is available before updating.
- Match the exact model and revision, because similar boards can use incompatible images.
- Never interrupt the flashing stage, even when the screen stays dark for several minutes.
- Recheck firmware settings afterward, since updates can reset boot order, Secure Boot keys or virtualization options.
- Pilot updates on a small group of machines before a fleet-wide rollout.
If a device fails to start after an update, recovery options include the automatic backup image, a vendor recovery key combination, a USB flashback port on some motherboards and, as a last resort, external reprogramming of the SPI chip.
The short version
Firmware is the built-in software that wakes a computer up and tells its hardware how to behave before Windows, macOS or Linux even appears. A firmware update replaces that built-in software with a newer version.
It is a bit like replacing the foundation of a house while people still live in it. Done carefully, the house becomes safer and sturdier. If the power fails halfway through, the house may not open its front door, which is why updates must never be interrupted.
Where it makes a difference
An IT administrator manages 600 office laptops after a vendor publishes a firmware release that fixes a high-severity vulnerability in the boot firmware and updates CPU microcode. The administrator first deploys the update to 20 pilot machines through the operating system update service, with BitLocker protection suspended for one restart.
One pilot laptop reports a reset boot order that tries network boot first, so the deployment script is extended to verify firmware settings afterward. The fleet-wide rollout then completes over two weeks with no unbootable devices and no recovery key prompts, and the firmware inventory confirms that every laptop now runs the patched version.