CVE-2024-37986 Overview
CVE-2024-37986 is a Secure Boot security feature bypass vulnerability affecting multiple versions of Microsoft Windows and Windows Server. Microsoft published the advisory on July 9, 2024. The flaw is rooted in an integer underflow condition [CWE-191] in the boot chain, which attackers can leverage to bypass Secure Boot integrity checks. Exploitation requires adjacent network access and user interaction, but successful attacks compromise confidentiality, integrity, and availability of the affected host. The vulnerability impacts Windows 10, Windows 11, and Windows Server versions from Server 2012 through Server 2022 23H2.
Critical Impact
A successful bypass allows an attacker to run untrusted boot components, undermining platform trust and enabling persistent pre-OS malware such as bootkits.
Affected Products
- Microsoft Windows 10 (1507, 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (21H2, 22H2, 23H2)
- Microsoft Windows Server 2012, 2016, 2019, 2022, and 2022 23H2
Discovery Timeline
- 2024-07-09 - CVE-2024-37986 published to NVD
- 2024-07-09 - Microsoft released the security update addressing the vulnerability
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-37986
Vulnerability Analysis
The vulnerability resides in the Secure Boot verification path used during the Windows boot process. Secure Boot validates the signature and integrity of boot components before they execute. An integer underflow [CWE-191] in the validation logic allows crafted input to wrap a size or offset calculation below zero. This wrapping causes downstream logic to misinterpret the boundaries of a boot object, ultimately allowing an unsigned or tampered component to pass integrity checks.
Because the flaw sits below the operating system, successful exploitation can persist across reinstalls and evade OS-level defenses. The attack complexity is low, and no privileges are required, but the attacker must be on an adjacent network and induce a user to perform an action, such as booting from attacker-supplied media or accepting a firmware update.
Root Cause
The root cause is an integer underflow during the parsing of boot component metadata. A subtraction against an attacker-influenced field produces a value that wraps around the unsigned integer range. Subsequent bounds checks trust this corrupted value, allowing malformed or malicious boot payloads to be treated as validated.
Attack Vector
An attacker on an adjacent network prepares a malicious boot image or bootloader. The victim must load the crafted component, typically through provisioning workflows, PXE boot, or externally supplied media. Once loaded, the underflow bypasses signature enforcement, and the malicious code executes with pre-OS privilege. The attacker can then install a bootkit, disable EDR at load, or intercept the OS load sequence.
No public proof-of-concept exploit is listed in the NVD data, and the CVE is not present in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2024-37986
Indicators of Compromise
- Unexpected changes to the EFI System Partition (\EFI\Microsoft\Boot\) including new or modified .efi binaries
- Secure Boot policy or DBX revocation list modifications outside of Microsoft update cycles
- Boot Configuration Data (BCD) entries pointing to unsigned or unknown loaders
- Measured Boot logs (TCG log) showing PCR values that diverge from the platform baseline
Detection Strategies
- Compare TPM-attested PCR[0-7] measurements against a known-good baseline for each hardware model
- Alert on writes to \Device\HarddiskVolume1\EFI\ from non-installer processes
- Correlate Microsoft-Windows-TPM-WMI and Microsoft-Windows-Kernel-Boot event logs for Secure Boot state changes
- Flag hosts reporting Confirm-SecureBootUEFI as False where policy requires it enabled
Monitoring Recommendations
- Enable Windows Defender System Guard and forward runtime attestation results to a central SIEM
- Ingest UEFI variable change events and boot integrity telemetry into the security data lake for retention and hunting
- Continuously verify DBX revocation list versions match Microsoft's current published values across the fleet
How to Mitigate CVE-2024-37986
Immediate Actions Required
- Apply the July 2024 Microsoft security update referenced in the Microsoft Security Update CVE-2024-37986 advisory to all affected Windows and Windows Server systems
- Verify Secure Boot is enabled on each host using Confirm-SecureBootUEFI in PowerShell
- Update the Secure Boot forbidden signature database (DBX) after patching to revoke vulnerable boot components
- Restrict physical and adjacent-network access to systems that boot from removable media or PXE
Patch Information
Microsoft published the fix on July 9, 2024, distributed through the standard monthly cumulative update channel. Refer to the Microsoft Security Update CVE-2024-37986 advisory for KB article numbers mapped to each affected Windows and Windows Server version. Reboot is required for the boot-path fix to take effect, and DBX updates may require a second reboot.
Workarounds
- Disable network boot (PXE) on endpoints that do not require it via UEFI firmware settings
- Require BitLocker with TPM+PIN protectors so a bypassed boot chain cannot silently unlock the OS volume
- Enforce boot integrity attestation as a conditional access signal before granting access to sensitive resources
# Verify Secure Boot state and DBX revocation list version on Windows
Confirm-SecureBootUEFI
Get-SecureBootUEFI -Name dbx | Select-Object Name, Bytes
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
