CVE-2024-37987 Overview
CVE-2024-37987 is a Secure Boot security feature bypass vulnerability affecting multiple versions of Microsoft Windows and Windows Server. The flaw is categorized under [CWE-122] (heap-based buffer overflow) and allows an attacker with adjacent network access to bypass Secure Boot integrity protections. Exploitation requires user interaction, which increases attack complexity but does not eliminate the risk in environments where users routinely open untrusted content. Successful exploitation compromises the confidentiality, integrity, and availability of the affected system by undermining the boot-time trust chain.
Critical Impact
An attacker who successfully exploits this vulnerability can bypass Secure Boot, enabling execution of unsigned or malicious pre-boot code that persists beneath the operating system.
Affected Products
- Microsoft Windows 10 (versions 1507, 1607, 1809, 21H2, 22H2)
- Microsoft Windows 11 (versions 21H2, 22H2, 23H2)
- Microsoft Windows Server 2012, 2016, 2019, 2022, and 23H2
Discovery Timeline
- 2024-07-09 - CVE-2024-37987 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-37987
Vulnerability Analysis
CVE-2024-37987 is a Secure Boot bypass rooted in a heap-based buffer overflow condition. Secure Boot validates firmware and bootloader components against trusted signatures before handing control to the operating system. When the boot component mishandles attacker-controlled data on the heap, it can be coerced into accepting or executing code that would otherwise fail signature verification.
Bypassing Secure Boot enables the loading of bootkits and unsigned drivers that survive operating system reinstalls. Malicious code executing before the OS loads gains privileged persistence and can subvert kernel-mode defenses. The vulnerability requires adjacent-network access and user interaction, meaning an attacker must reach the target through a shared network segment and induce a user action.
Root Cause
The underlying weakness is a heap-based buffer overflow [CWE-122] in a Windows boot-related component that participates in Secure Boot enforcement. Improper bounds checking on heap-allocated buffers allows crafted input to corrupt adjacent memory structures used during signature validation or component loading.
Attack Vector
An attacker on an adjacent network delivers a crafted payload that reaches the vulnerable component during a boot or update flow requiring user interaction. Because no verified public proof-of-concept is available, exploitation details remain limited. Refer to the Microsoft Security Response Center advisory for CVE-2024-37987 for vendor-supplied technical context.
No verified exploit code is publicly available for this vulnerability. The vulnerability mechanism is described in prose above; see the Microsoft advisory for further technical detail.
Detection Methods for CVE-2024-37987
Indicators of Compromise
- Unexpected changes to Secure Boot state or dbx (revocation) contents on managed endpoints.
- Unsigned or unknown bootloader binaries present in the EFI System Partition.
- Boot integrity measurements in the TPM event log that deviate from a known-good baseline.
- Firmware or bootloader update events initiated outside of authorized patch windows.
Detection Strategies
- Compare TPM PCR measurements against attested baselines to detect boot component tampering.
- Alert on modifications to files under the EFI System Partition (\EFI\Microsoft\Boot\) outside sanctioned update processes.
- Monitor Windows event logs for Microsoft-Windows-TPM-WMI and Kernel-Boot anomalies indicating altered boot configuration.
- Correlate patch state telemetry with hosts still reporting pre-July 2024 Windows build numbers.
Monitoring Recommendations
- Enable Measured Boot logging and centralize TPM attestation results in your SIEM or data lake.
- Track Secure Boot configuration drift across Windows and Windows Server fleets using configuration management tooling.
- Baseline authorized bootloader hashes and generate alerts when new hashes appear.
How to Mitigate CVE-2024-37987
Immediate Actions Required
- Apply the Microsoft security update referenced in the MSRC advisory for CVE-2024-37987 to all affected Windows and Windows Server systems.
- Verify Secure Boot is enabled and enforcing on all endpoints and servers where the platform supports it.
- Prioritize patching for systems reachable from untrusted or shared network segments where adjacent-network access is feasible.
Patch Information
Microsoft addressed CVE-2024-37987 through cumulative security updates covering Windows 10 (1507 through 22H2), Windows 11 (21H2 through 23H2), and Windows Server 2012 through 23H2. Consult the MSRC advisory for the KB article corresponding to each affected build.
Workarounds
- Restrict physical and adjacent-network access to endpoints where patch deployment is delayed.
- Enforce BitLocker with TPM+PIN to add a pre-boot authentication factor that limits attacker interaction.
- Segment legacy Windows Server systems and remove them from user-facing network zones until patched.
# Verify Secure Boot state on Windows (PowerShell)
Confirm-SecureBootUEFI
# List installed updates to confirm the July 2024 (or later) patch is present
Get-HotFix | Sort-Object -Property InstalledOn -Descending | Select-Object -First 20
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
