CVE-2024-37971 Overview
CVE-2024-37971 is a Secure Boot security feature bypass vulnerability affecting Microsoft Windows client and server operating systems. Microsoft published the advisory on July 9, 2024, as part of its monthly security update cycle. The flaw is classified under [CWE-121] (Stack-based Buffer Overflow) and can be leveraged by an attacker on an adjacent network to bypass the Secure Boot trust boundary.
Successful exploitation requires user interaction but grants high impact to confidentiality, integrity, and availability. An attacker who bypasses Secure Boot can load unsigned or malicious code before the operating system starts, undermining the platform's chain of trust.
Critical Impact
A successful bypass of Secure Boot allows execution of untrusted code at the firmware boot stage, enabling persistence below the operating system and evasion of endpoint controls.
Affected Products
- Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (versions 21H2, 22H2, 23H2)
- Microsoft Windows Server 2012, 2016, 2019, 2022, and Server 2022 23H2
Discovery Timeline
- 2024-07-09 - CVE-2024-37971 published to NVD
- 2024-07-09 - Microsoft released a security patch through the July 2024 Patch Tuesday cycle
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-37971
Vulnerability Analysis
CVE-2024-37971 is a Secure Boot bypass rooted in a stack-based buffer overflow [CWE-121] in a Windows boot component. Secure Boot is a UEFI feature that validates the signatures of firmware, bootloaders, and kernel components before execution. An attacker who overflows a fixed-size stack buffer during the pre-boot validation path can corrupt control data and divert execution flow.
The vulnerability affects a broad range of Windows client and server versions, indicating shared boot-stage code across the supported product family. Exploitation requires adjacent network access and user interaction, which is consistent with scenarios involving PXE-based boot flows, network-attached boot images, or attacker-controlled media presented during startup.
Because the flaw sits in the pre-OS trust chain, a successful exploit can subvert every mitigation that assumes an untampered boot. This includes measured boot attestations, BitLocker key release logic, and kernel-mode integrity checks.
Root Cause
The root cause is improper bounds checking on data processed during the Secure Boot validation sequence. When oversized input is parsed, the routine writes past the end of a stack buffer, corrupting the saved return address or adjacent control structures. This behavior maps to [CWE-121].
Attack Vector
The attack vector is adjacent network with low complexity, no privileges required, and user interaction required. An attacker within Layer 2 broadcast reach can deliver crafted boot content that triggers the overflow when the victim boots or reboots the machine. See the Microsoft CVE-2024-37971 Advisory for vendor-specific exploitation notes.
No verified public proof-of-concept code is available. Technical exploitation details are described in prose only; consult the vendor advisory for authoritative information.
Detection Methods for CVE-2024-37971
Indicators of Compromise
- Unexpected changes to UEFI variables, boot order entries, or the Windows Boot Configuration Data (BCD) store on managed endpoints.
- Unsigned or unknown bootloaders appearing in the EFI System Partition (\EFI\Microsoft\Boot\).
- Measured Boot logs (TPM PCR values) that diverge from a known-good baseline across a fleet.
Detection Strategies
- Compare Windows Defender System Guard runtime attestation and TPM PCR measurements against golden baselines to identify boot-chain tampering.
- Monitor Windows Event Log channels Microsoft-Windows-Kernel-Boot/Operational and Microsoft-Windows-TPM-WMI for anomalous boot events.
- Inventory installed KB numbers to confirm that the July 2024 cumulative update addressing CVE-2024-37971 is applied on every affected host.
Monitoring Recommendations
- Alert on repeated PXE or network boot requests originating from unexpected VLAN segments where adjacent-network exploitation would be feasible.
- Track modifications to files in the EFI System Partition and to Secure Boot policy variables (db, dbx, KEK, PK).
- Correlate reboot events with subsequent driver, service, or scheduled task creation to detect boot-time persistence attempts.
How to Mitigate CVE-2024-37971
Immediate Actions Required
- Apply the July 2024 (or later) Windows cumulative security update to all affected Windows 10, Windows 11, and Windows Server systems.
- Verify that Secure Boot is enabled in UEFI firmware and that the platform is enrolled with a current DBX revocation list.
- Restrict physical and adjacent-network access to endpoints, and disable PXE boot on systems that do not require it.
Patch Information
Microsoft addressed CVE-2024-37971 in the July 9, 2024 security updates. Refer to the Microsoft CVE-2024-37971 Advisory for the full list of KB articles mapped to each affected Windows build. Deploy the update through Windows Update, WSUS, Microsoft Configuration Manager, or Intune, prioritizing systems that support network boot or shared boot media.
Workarounds
- Disable network boot (PXE) in UEFI firmware on endpoints that do not require it operationally.
- Enforce firmware passwords and restrict boot device selection to prevent adversaries from steering the boot process.
- Segment networks so that endpoints cannot receive boot payloads from untrusted adjacent hosts.
# Verify Secure Boot status and applied updates on Windows
Confirm-SecureBootUEFI
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
