CVE-2024-28899: Windows 10 1507 Secure Boot Bypass Flaw

CVE-2024-28899 Overview

CVE-2024-28899 is a Secure Boot security feature bypass vulnerability affecting a broad range of Microsoft Windows client and server operating systems. The flaw allows an adjacent-network attacker with no authentication and no user interaction to compromise the integrity, confidentiality, and availability of affected systems. The vulnerability is associated with a stack-based buffer overflow [CWE-121] in the Secure Boot code path.

Microsoft published guidance for this issue in the Microsoft CVE-2024-28899 Advisory. The vulnerability was published to the National Vulnerability Database on July 9, 2024.

Critical Impact
Successful exploitation bypasses Secure Boot, enabling attackers to run untrusted boot components and undermine the platform integrity guarantees relied on by Windows and defensive tooling.

Affected Products

Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
Microsoft Windows 11 (versions 21H2, 22H2, 23H2)
Microsoft Windows Server 2012, 2016, 2019, 2022, and Server 2022 23H2

Discovery Timeline

2024-07-09 - CVE-2024-28899 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-28899

Vulnerability Analysis

CVE-2024-28899 is a Secure Boot bypass rooted in a stack-based buffer overflow [CWE-121] within Windows boot-path components. Secure Boot verifies firmware and bootloader components against a trust chain anchored in platform keys. When that verification path contains a memory-safety flaw, an attacker can subvert the checks and execute unsigned or attacker-controlled code before the operating system loads.

The flaw is exploitable from an adjacent network position without credentials or user interaction. An attacker who reaches the affected code path can corrupt stack memory during boot component processing, redirect execution, and load malicious pre-OS code such as a bootkit. This gives the attacker persistence beneath the operating system and the ability to disable or blind endpoint security controls.

Root Cause

The root cause is improper bounds checking in a Secure Boot processing routine, classified under [CWE-121] (Stack-based Buffer Overflow). Attacker-influenced input consumed during the Secure Boot verification sequence overruns a fixed-size stack buffer. Microsoft has not publicly disclosed the specific component or function to prevent reverse engineering of the fix.

Attack Vector

The attack vector is Adjacent Network. Exploitation requires the attacker to be on the same logical network segment or share a broadcast or collision domain with the target. Combined with no privileges required and no user interaction, this vector is realistic for shared corporate LANs, guest Wi-Fi environments, and lateral movement scenarios where an attacker has already established a foothold on a nearby host.

No public proof-of-concept exploit is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS score indicates a moderate probability of exploitation activity relative to other CVEs in the same window. See the Microsoft CVE-2024-28899 Advisory for vendor technical details.

Detection Methods for CVE-2024-28899

Indicators of Compromise

Unexpected changes to Secure Boot state, dbx (forbidden signatures) database, or UEFI variables reported by Confirm-SecureBootUEFI or platform management tooling.
Bootloader or bootmgfw.efi binaries with hashes that do not match Microsoft-published values.
Boot configuration data (BCD) modifications, unexpected boot entries, or new EFI system partition files appearing outside patch windows.
Endpoint agents reporting tamper events, driver load failures, or missing early-boot telemetry after reboot.

Detection Strategies

Collect and baseline TPM PCR values (PCR[0]–PCR[7]) across the fleet and alert on drift, which can indicate boot component tampering.
Use Windows Defender System Guard runtime attestation and Measured Boot logs to detect pre-OS integrity violations.
Monitor Microsoft-Windows-Kernel-Boot and TPM event log channels for anomalous entries around reboot events.

Monitoring Recommendations

Correlate adjacent-network anomalies such as rogue DHCP, PXE, or ARP activity with reboot and boot integrity events on nearby hosts.
Track firmware and Secure Boot revocation database (dbx) revision levels across endpoints and servers to confirm patches applied successfully.
Alert on hosts that fail attestation or report Secure Boot disabled after previously reporting it enabled.

How to Mitigate CVE-2024-28899

Immediate Actions Required

Apply Microsoft's cumulative security updates that address CVE-2024-28899 to all affected Windows client and server versions per the Microsoft CVE-2024-28899 Advisory.
Prioritize systems exposed to shared or untrusted network segments, including laptops that connect to guest, hotel, and conference Wi-Fi.
Verify Secure Boot is enabled (Confirm-SecureBootUEFI returns True) and that TPM-based measured boot is configured on all managed endpoints.
Apply corresponding Secure Boot dbx updates so revoked boot components cannot be reloaded on patched systems.

Patch Information

Microsoft addresses CVE-2024-28899 through Windows security updates distributed via Windows Update, WSUS, and the Microsoft Update Catalog. Full remediation may require both an operating system update and a Secure Boot revocation list (dbx) update. Consult the Microsoft CVE-2024-28899 Advisory for build numbers and KB references applicable to each affected Windows version.

Workarounds

Segment sensitive endpoints and servers away from untrusted adjacent networks using VLANs, private VLANs, and wireless client isolation.
Enforce 802.1X network access control to prevent unauthorized devices from reaching the adjacent-network attack surface.
Enable BitLocker with TPM+PIN so unauthorized pre-OS code changes trigger recovery and are surfaced to administrators.
Where feasible, enable virtualization-based security (VBS) and HVCI to raise the cost of post-exploitation kernel tampering.

bash

# Verify Secure Boot and measured boot state on Windows hosts
Confirm-SecureBootUEFI
Get-Tpm
Get-WinEvent -LogName Microsoft-Windows-Kernel-Boot | Select-Object -First 20

# Confirm patch level after update deployment
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 10