CVE-2024-37977 Overview
CVE-2024-37977 is a Secure Boot security feature bypass vulnerability affecting Microsoft Windows 11 and Windows Server 2022. The flaw is tracked under CWE-122 (Heap-based Buffer Overflow) and allows an attacker on an adjacent network to bypass Secure Boot integrity protections when a user performs a required action. Successful exploitation yields high impact to confidentiality, integrity, and availability of the targeted system.
Critical Impact
An attacker who successfully exploits CVE-2024-37977 can bypass Secure Boot, allowing execution of untrusted code before the operating system loads and undermining the platform's root of trust.
Affected Products
- Microsoft Windows 11 (21H2, 22H2, 23H2)
- Microsoft Windows Server 2022
- Microsoft Windows Server 2022 23H2
Discovery Timeline
- 2024-07-09 - CVE-2024-37977 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-37977
Vulnerability Analysis
CVE-2024-37977 is a Secure Boot bypass rooted in a heap-based buffer overflow condition (CWE-122). Secure Boot is a UEFI feature that verifies the cryptographic signature of firmware, bootloaders, and operating system components before execution. Bypassing this protection allows unsigned or attacker-controlled code to run during the pre-boot environment.
The vulnerability requires user interaction and adjacent-network access, meaning the attacker must be on the same logical network segment as the target. Because the flaw manifests in a boot-time trust boundary, exploitation can persist across reboots and evade defenses that only activate after the operating system initializes.
Microsoft has not published detailed technical internals. Refer to the Microsoft Security Response Center advisory for authoritative product guidance.
Root Cause
The root cause is a heap-based buffer overflow in a component involved in the Secure Boot validation path. When a specially crafted input is processed, memory adjacent to a heap allocation is overwritten, corrupting control data used to enforce boot integrity checks.
Attack Vector
The attack vector is adjacent-network with low complexity and no privileges required, but user interaction is required. An attacker must deliver a crafted payload to the target and induce a user to perform an action that triggers the vulnerable code path during boot or update processing. See the Microsoft advisory for authoritative exploitation prerequisites.
No public proof-of-concept code or exploit-in-the-wild reports have been observed for CVE-2024-37977 at time of writing.
Detection Methods for CVE-2024-37977
Indicators of Compromise
- Unexpected changes to UEFI variables, Secure Boot policy databases (db, dbx, KEK, PK), or the Boot Configuration Data (BCD) store.
- Presence of unsigned or unknown bootloader binaries in the EFI System Partition (ESP).
- Event Log entries indicating Secure Boot state transitions or measured boot log anomalies in TPM PCR values.
Detection Strategies
- Monitor Windows Event Log channels Microsoft-Windows-Kernel-Boot and Microsoft-Windows-TPM-WMI for boot integrity anomalies and Secure Boot state changes.
- Use Windows Defender Device Guard and measured boot attestation to verify that expected PCR values are reported to a remote attestation service.
- Correlate boot-time telemetry with EDR data to identify hosts whose pre-boot components deviate from a known-good baseline.
Monitoring Recommendations
- Enroll endpoints in a remote health attestation service to continuously validate boot integrity.
- Track patch compliance for the July 2024 Microsoft security updates across all Windows 11 and Server 2022 hosts.
- Alert on adjacent-network anomalies such as rogue DHCP, PXE, or WDS servers that could stage payloads targeting boot components.
How to Mitigate CVE-2024-37977
Immediate Actions Required
- Apply the Microsoft security update for CVE-2024-37977 to all affected Windows 11 and Windows Server 2022 systems as documented in the MSRC advisory.
- Verify Secure Boot is enabled and enforced in UEFI firmware on every endpoint and server.
- Restrict adjacent-network exposure by segmenting management, provisioning, and boot-service networks from general user traffic.
Patch Information
Microsoft addressed CVE-2024-37977 in the July 2024 Patch Tuesday cycle. Consult the Microsoft CVE-2024-37977 Advisory for the exact KB article numbers corresponding to each affected Windows build and apply them through Windows Update, WSUS, or your preferred patch management tool.
Workarounds
- If patching cannot be performed immediately, restrict physical and adjacent-network access to affected systems.
- Enforce BitLocker with TPM+PIN pre-boot authentication so that boot-tampering attempts require additional attacker interaction.
- Update the UEFI revocation list (dbx) with the latest Microsoft-published revocations once the vendor issues associated forbidden-signature updates.
# Verify Secure Boot status on Windows (PowerShell, run as Administrator)
Confirm-SecureBootUEFI
# Review Secure Boot policy and UEFI variables
Get-SecureBootPolicy
Get-SecureBootUEFI -Name PK
Get-SecureBootUEFI -Name KEK
# Confirm applied security updates (example: list installed hotfixes)
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
