CVE-2024-37981 Overview
CVE-2024-37981 is a Secure Boot security feature bypass vulnerability affecting multiple versions of Microsoft Windows and Windows Server. The flaw is tracked under CWE-191 (Integer Underflow) and requires an attacker on an adjacent network with user interaction to exploit. Successful exploitation compromises the integrity of the Secure Boot trust chain, which normally enforces that only signed, trusted code executes during platform boot. Microsoft published the advisory on July 9, 2024 as part of its monthly security update cycle.
Critical Impact
An adjacent-network attacker who convinces a user to perform a specific action can bypass Secure Boot on affected Windows systems, undermining pre-OS integrity guarantees and enabling persistent, low-level compromise.
Affected Products
- Microsoft Windows 10 (versions 1809, 21H2, 22H2)
- Microsoft Windows 11 (versions 21H2, 22H2, 23H2)
- Microsoft Windows Server 2019, Server 2022, and Server 2022 23H2
Discovery Timeline
- 2024-07-09 - CVE-2024-37981 published to NVD alongside Microsoft's July 2024 Patch Tuesday release
- 2026-06-17 - Last updated in the NVD database
Technical Details for CVE-2024-37981
Vulnerability Analysis
CVE-2024-37981 is classified as a Secure Boot Bypass rooted in an integer underflow condition (CWE-191). Secure Boot validates the cryptographic signatures of firmware and bootloader components before the operating system loads. A bypass in this trust chain allows unsigned or attacker-controlled code to execute at the pre-OS stage, before endpoint protection is active.
Exploitation requires an adjacent-network position and user interaction, which limits opportunistic attacks but is well within reach of targeted intrusion scenarios such as compromised guest networks, malicious peripherals, or lateral movement from an already-compromised host on the same broadcast segment. An attacker who succeeds can install bootkit-class implants that survive OS reinstallation and evade user-mode defenses.
Root Cause
The underlying weakness is an integer underflow in a Secure Boot-related component. When a size or length value is decremented below zero and wraps around to a large unsigned value, downstream logic operates on incorrect bounds. This condition can be leveraged to skip or subvert signature-validation checks that Secure Boot depends on for enforcing image trust.
Attack Vector
The attack path requires proximity to the target and a triggering user action, such as connecting to an attacker-controlled network resource or accepting a malicious update artifact delivered over an adjacent link. Once the crafted input reaches the vulnerable Secure Boot code path, the underflow condition disables the integrity check and permits execution of unsigned boot components. No public proof-of-concept or in-the-wild exploitation has been documented in CISA KEV for this CVE.
Refer to the Microsoft Security Update Guide for vendor-specific technical details.
Detection Methods for CVE-2024-37981
Indicators of Compromise
- Unexpected changes to UEFI variables, boot order, or entries in the EFI System Partition (\EFI\Microsoft\Boot\).
- Presence of unsigned or unknown .efi binaries, or modifications to bootmgfw.efi and winload.efi hashes.
- Secure Boot state reporting as disabled or misconfigured on hosts previously confirmed as enabled (Confirm-SecureBootUEFI returning False).
- Boot configuration data (BCD) entries referencing unusual loaders or test-signing flags.
Detection Strategies
- Baseline and monitor UEFI/Secure Boot posture across the fleet, alerting on drift from a known-good measured-boot state.
- Ingest Windows event logs from Microsoft-Windows-Kernel-Boot and TPM measured-boot logs into a SIEM to identify anomalous boot sequences.
- Correlate adjacent-network activity (rogue DHCP, unexpected PXE, LLMNR/NBT-NS anomalies) with subsequent boot configuration changes on endpoints.
Monitoring Recommendations
- Track Windows Update compliance to confirm the July 2024 (and later) cumulative updates are installed on all affected SKUs.
- Monitor TPM PCR values through attestation services to detect changes to pre-OS components.
- Alert on execution of tools that manipulate boot configuration, such as bcdedit.exe /set testsigning on or unauthorized use of mokutil equivalents.
How to Mitigate CVE-2024-37981
Immediate Actions Required
- Apply the Microsoft security updates referenced in the Microsoft Security Update Guide to all affected Windows 10, Windows 11, and Windows Server systems.
- Verify Secure Boot remains enabled after patching using Confirm-SecureBootUEFI in PowerShell.
- Prioritize patching for endpoints on shared or untrusted network segments where adjacent-network access is plausible.
Patch Information
Microsoft addressed CVE-2024-37981 through cumulative updates released on July 9, 2024 for all listed Windows client and server versions. Administrators should confirm that the corresponding KB articles for each SKU are installed and that Secure Boot DBX revocation databases are current. Consult the vendor advisory for the specific KB numbers applicable to each Windows build.
Workarounds
- Restrict adjacent-network exposure by segmenting untrusted VLANs, disabling unused wireless interfaces, and enforcing 802.1X on wired networks.
- Enforce user awareness controls to reduce the likelihood of the required user interaction, particularly around untrusted peripherals and network prompts.
- Enable BitLocker with TPM+PIN so that pre-OS tampering triggers recovery-key prompts and surfaces integrity violations.
# Verify Secure Boot state and patch level on Windows hosts
Confirm-SecureBootUEFI
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 10
Get-WindowsUpdateLog
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
