CVE-2024-37975 Overview
CVE-2024-37975 is a Secure Boot security feature bypass vulnerability affecting multiple versions of Microsoft Windows and Windows Server. The flaw stems from an integer underflow condition [CWE-191] in boot-related components. An adjacent-network attacker who can convince a user to perform specific actions may bypass Secure Boot protections. Successful exploitation compromises confidentiality, integrity, and availability of the affected system. Microsoft addressed the issue in its July 2024 Patch Tuesday release.
Critical Impact
A successful bypass of Secure Boot removes a foundational Windows platform integrity control, enabling loading of untrusted code during the boot process and undermining downstream OS security guarantees.
Affected Products
- Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (versions 21H2, 22H2, 23H2)
- Microsoft Windows Server 2012, 2016, 2019, 2022, and Server 2022 23H2
Discovery Timeline
- 2024-07-09 - CVE-2024-37975 published to NVD
- 2024-07-09 - Microsoft releases security patch through Patch Tuesday
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-37975
Vulnerability Analysis
CVE-2024-37975 is classified as a Secure Boot Bypass driven by an integer underflow [CWE-191]. Secure Boot validates firmware and bootloader signatures against a trusted database before execution. An underflow in a size or length calculation during boot processing can cause a value to wrap to a large unsigned integer. That miscalculation lets an attacker influence memory operations or validation logic that would normally reject unsigned or tampered components.
Exploitation requires user interaction and access to the adjacent network. The scope remains unchanged, but a successful bypass affects confidentiality, integrity, and availability at high impact. Because Secure Boot underpins boot-time trust, a bypass can persist across reboots and evade OS-level protections loaded later in the boot chain.
Root Cause
The root cause is an integer underflow within a Secure Boot code path. When an attacker-controlled input reduces a length or offset value below zero, unsigned arithmetic produces an oversized value. Subsequent buffer handling or signature validation logic operates on incorrect bounds, allowing untrusted boot content to be treated as validated.
Attack Vector
The attack vector is Adjacent Network with low complexity and no privileges required. The attacker must induce a user to interact with a crafted resource on the same logical network segment. A successful chain results in Secure Boot being bypassed on the affected Windows or Windows Server host. Refer to the Microsoft Security Update CVE-2024-37975 for authoritative technical details.
// No verified public proof-of-concept code is available for CVE-2024-37975.
// The vulnerability mechanism is described in prose above.
Detection Methods for CVE-2024-37975
Indicators of Compromise
- Unexpected changes to Secure Boot configuration, UEFI variables, or the boot order on Windows endpoints and servers.
- Presence of unsigned or unknown bootloaders, .efi binaries, or drivers loaded during the boot chain.
- Boot integrity measurements in the TPM event log that deviate from a known-good baseline.
Detection Strategies
- Compare TPM Platform Configuration Register (PCR) values and Windows Measured Boot logs against a trusted baseline to identify boot-time tampering.
- Monitor Windows event logs for Secure Boot state transitions, boot configuration data (BCD) modifications, and driver signing policy changes.
- Use attestation services (for example, Windows Defender System Guard or Azure Attestation) to flag hosts whose boot state diverges from policy.
Monitoring Recommendations
- Alert on hosts reporting Secure Boot disabled or in setup mode where policy requires it to be enabled.
- Track KB article deployment status across the fleet to identify unpatched Windows and Windows Server systems.
- Correlate authentication anomalies with recent boot events to surface post-boot compromise following a suspected bypass.
How to Mitigate CVE-2024-37975
Immediate Actions Required
- Apply the Microsoft July 2024 security updates that address CVE-2024-37975 to all affected Windows 10, Windows 11, and Windows Server systems.
- Verify Secure Boot is enabled in firmware and enforced by policy on every endpoint and server.
- Prioritize patching for systems that process untrusted content or operate in shared network segments.
Patch Information
Microsoft published the fix in its July 9, 2024 security update cycle. Administrators should consult the Microsoft Security Update CVE-2024-37975 advisory to identify the correct KB for each Windows build and validate installation status via Windows Update or WSUS reporting.
Workarounds
- No official workaround replaces the patch; Microsoft recommends installing the security update.
- Restrict adjacent-network exposure by segmenting untrusted networks and disabling unused wireless or link-local interfaces.
- Enforce user awareness controls to reduce the likelihood of the required user interaction step succeeding.
# Verify Secure Boot status and patch level on a Windows host (PowerShell)
Confirm-SecureBootUEFI
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
