CVE-2023-24932: Secure Boot Security Feature Bypass Vulnerability

Overview

Severity

Medium (CVSS 6.7)

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

Category

Security Feature Bypass

Exploit Status

Actively Exploited

Exploitation Likelihood

Detected

Publicly Disclosed

Yes

Patch Tuesday

2023-May

Released

2023-05-09

Last Updated

2025-07-10

EPSS Score

0.56% (percentile: 68.5%)

FAQ

According to the CVSS metric, privileges required is high (PR:H). What does that mean for this vulnerability? Successful exploitation of this vulnerability requires an attacker to compromise admin credentials on the device. How can an attacker successfully exploit this vulnerability? To exploit the vulnerability, an attacker who has physical access or Administrative rights to a target device could install an affected boot policy. What kind of security feature could be bypassed by successfully exploiting this vulnerability? An attacker who successfully exploited this vulnerability could bypass Secure Boot. Are there additional steps I need to take to be protected from this vulnerability? The security update addresses the vulnerability by updating the Windows Boot Manager, but is not enabled by default. Additional steps are required at this time to mitigate the vulnerability. Please refer to the following for steps to determine impact on your environment: KB5025885: How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932. I am running Window 11 23H2 or Server 2022, 23H2 Edition, What do I need to do to be protected from this vulnerability? Protections for the Secure Boot bypass were included in Windows 11 Version 23H3 and Windows Server 2022, 23H2 Edition at the time of their release; however, these protections are not enabled by default. Customers running these versions of Windows must enable the protections as outlined in KB5025885: How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932.

Detection & Weaponization (1 sources)

Maturity: Exploit

• GitHub PoC: 3 repositories

Affected Products (42)

Windows

• Windows Server 2025 (Server Core installation)
• Windows 11 Version 24H2 for ARM64-based Systems
• Windows 11 Version 24H2 for x64-based Systems
• Windows Server 2025
• Windows 10 Version 1809 for 32-bit Systems
• Windows 10 Version 1809 for x64-based Systems
• Windows 10 Version 1809 for ARM64-based Systems
• Windows Server 2019
• Windows Server 2019 (Server Core installation)
• Windows Server 2022
• Windows Server 2022 (Server Core installation)
• Windows 10 Version 20H2 for 32-bit Systems
• Windows 10 Version 20H2 for ARM64-based Systems
• Windows 11 version 21H2 for x64-based Systems
• Windows 11 version 21H2 for ARM64-based Systems
• Windows 10 Version 21H2 for 32-bit Systems
• Windows 10 Version 21H2 for ARM64-based Systems
• Windows 10 Version 21H2 for x64-based Systems
• Windows 11 Version 22H2 for ARM64-based Systems
• Windows 11 Version 22H2 for x64-based Systems
• Windows 10 Version 22H2 for x64-based Systems
• Windows 10 Version 22H2 for ARM64-based Systems
• Windows 10 Version 22H2 for 32-bit Systems
• Windows 11 Version 23H2 for ARM64-based Systems
• Windows 11 Version 23H2 for x64-based Systems
• Windows Server 2022, 23H2 Edition (Server Core installation)
• Windows 10 for 32-bit Systems
• Windows 10 for x64-based Systems
• Windows 10 Version 1607 for 32-bit Systems
• Windows 10 Version 1607 for x64-based Systems
• Windows Server 2016
• Windows Server 2016 (Server Core installation)

ESU

• Windows Server 2008 for 32-bit Systems Service Pack 2
• Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
• Windows Server 2008 for x64-based Systems Service Pack 2
• Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
• Windows Server 2008 R2 for x64-based Systems Service Pack 1
• Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
• Windows Server 2012
• Windows Server 2012 (Server Core installation)
• Windows Server 2012 R2
• Windows Server 2012 R2 (Server Core installation)

Security Updates (17)

• 5062553
• 5062557
• 5040430
• 5062572
• 5026361
• 5040431
• 5062554
• 5062552
• 5062570
• 5062561
• 5062560
• 5062624
• 5062618
• 5062632
• 5062619
• 5062592
• 5062597

Acknowledgments

Tomer Sne-or with SentinelOne, Martin Smolar with ESET, Zammis Clark

Revision History

• 2023-05-09: Information published.
• 2023-07-11: In the Security Updates table, added all supported versions of all supported versions of .NET Framework, Visual Studio 2022 version 17.0, Visual Studio 2022 version 17.2, and Visual Studio 2022 version 17.4 because these products are also affected by this vulnerability. Microsoft strongly recommends that customers running any of these products install the updates to be fully protected from the vulnerability. Customers whose systems are configured to receive automatic updates do not need to take any further action.
• 2023-07-14: CORRECTED REVISION: To comprehensively address CVE-2023-24932, Microsoft has released July 2023 security updates for all affected versions of Microsoft Windows. Microsoft strongly recommends that customers install the updates to be fully protected from the vulnerability. Additional steps are required after the update is installed. See KB5025885: How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 for more information.
• 2023-07-18: Removed the Security Hotpatch Update for the July 2023 revision as that package doesn't exist for this release cycle. You must install the Security Update to get the updated software.
• 2024-01-26: Updated FAQs to include information on how to be protected from this vulnerability for customers running Windows 11 23H2 or Windows Server 2022, 23H2 Edition. This is an informational change only.
• 2024-04-09: In the Security Updates table, added Windows 11 version 23H2 for x64-based systems and Windows 11 version 23H2 for ARM-based systems because the April 2024 security updates provide the latest mitigations. Note that these mitigations are off by default. Customers who should take additional steps to implement security mitigations for a publicly disclosed Secure Boot bypass leveraged by the BlackLotus UEFI bootkit and who would like to take a proactive security stance or to begin preparing for the rollout, please refer to KB5025885: How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 - Microsoft Support.
• 2024-07-09: Updated the Security Updates table to include the July 9, 2024 updates. These updates include support for opting into an updated Secure Version Number to block older boot managers.
• 2025-02-11: The following updates have been made to CVE-2023-24932: 1) In the Security Updates table, added all supported versions of the following as they are affected by this vulnerability: Windows 11 24H2 and Windows Server 2025. 2) Further, to comprehensively address this vulnerability, Microsoft has released February 2025 security updates for all affected versions of Windows 11 version 22H2 and Windows 11 version 23H2. Microsoft recommends that customers install the updates to be fully protected from the vulnerability. Customers whose systems are configured to receive automatic updates do not need to take any further action.
• 2025-07-10: Microsoft has released July 8, 2025 security updates for all supported versions of Windows that provide new mitigations to protect against this vulnerability; however, these mitigations are not enabled by default. After you have installed the updates, follow the steps outlined in KB5025885: How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 to enable these protections. All Windows devices should have the the July 8, 2025 security updates installed regardless of your plan to enable the mitigations.