CVE-2024-28925 Overview
CVE-2024-28925 is a Secure Boot security feature bypass vulnerability affecting a broad range of Microsoft Windows client and server operating systems. The flaw permits an attacker with adjacent network access to circumvent Secure Boot integrity checks, provided user interaction occurs. Microsoft published the advisory on April 9, 2024, and the National Vulnerability Database (NVD) classifies the underlying weakness under [CWE-121] Stack-based Buffer Overflow.
A successful bypass undermines the chain of trust established during platform boot, enabling execution of unauthorized bootloaders or firmware components. This weakens protections against bootkits and pre-OS malware that persist below endpoint security tooling.
Critical Impact
Bypassing Secure Boot allows attackers to load untrusted boot components, compromising system integrity from the earliest stages of the boot process and evading operating system defenses.
Affected Products
- Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (21H2, 22H2, 23H2)
- Microsoft Windows Server 2008, 2012, 2016, 2019, 2022, and 2022 23H2
Discovery Timeline
- 2024-04-09 - CVE-2024-28925 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-28925
Vulnerability Analysis
CVE-2024-28925 is a Secure Boot bypass rooted in a stack-based buffer overflow ([CWE-121]) within Windows boot components. Secure Boot verifies the cryptographic signature of every boot binary before execution to prevent unauthorized code from loading. When the overflow is triggered, boot-time validation logic can be corrupted, allowing an attacker to subvert signature enforcement.
Exploitation requires adjacent network access and user interaction. The impact spans confidentiality, integrity, and availability because a bypass at the boot layer grants pre-operating-system control. Malicious code running before the kernel loads can disable security controls, tamper with drivers, or install persistent bootkits.
Root Cause
The root cause is improper bounds checking on data processed during Secure Boot verification. Oversized input written into a fixed-size stack buffer overwrites adjacent memory, corrupting execution flow within the trusted boot path. This defeats the integrity assurances Secure Boot is designed to provide.
Attack Vector
The attack vector is adjacent (AV:A), meaning the attacker must be on the same logical network segment as the target. User interaction is required to trigger the vulnerable code path, typically by initiating a boot or firmware update operation that processes attacker-controlled data. See the Microsoft Security Update Guide for the vendor's technical description.
No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2024-28925
Indicators of Compromise
- Unexpected modifications to EFI System Partition (\EFI\Microsoft\Boot\) contents, including new or replaced .efi binaries
- Secure Boot state transitioning from enabled to disabled without administrative action
- Unsigned or unknown-signer boot loader entries appearing in firmware boot order
- Measured Boot logs (TPM PCR values) diverging from established baselines
Detection Strategies
- Enable and monitor Windows Defender System Guard and Measured Boot attestation to identify boot-integrity deviations
- Collect and analyze firmware and boot event logs through a centralized SIEM to correlate unexpected boot sequence changes
- Use device health attestation services to flag endpoints that fail Secure Boot verification post-reboot
Monitoring Recommendations
- Track TPM PCR[0-7] measurements across the fleet and alert on drift from known-good values
- Audit EFI variable modifications, particularly changes to PK, KEK, db, and dbx keys that govern Secure Boot trust anchors
- Monitor firmware update activity and correlate with authorized change windows
How to Mitigate CVE-2024-28925
Immediate Actions Required
- Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all affected Windows and Windows Server systems
- Verify Secure Boot is enabled in firmware settings on every managed endpoint and server
- Restrict physical and adjacent network access to systems that cannot be patched immediately
Patch Information
Microsoft released fixes as part of the April 2024 Patch Tuesday cycle. Administrators should deploy the applicable cumulative updates for each affected Windows and Windows Server version. Consult the Microsoft Security Update Guide for KB article numbers mapped to each build.
Workarounds
- Enforce network segmentation to prevent untrusted devices from reaching unpatched hosts on the same broadcast domain
- Require administrative approval for firmware and boot loader updates through change control processes
- Deploy TPM-based measured boot attestation and quarantine endpoints that fail attestation checks
# Verify Secure Boot status on Windows
Confirm-SecureBootUEFI
# List current Secure Boot policy and signer database
Get-SecureBootPolicy
# Confirm applied security updates
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
