Microsoft CVE-2026-0390

The Windows Boot Loader is a low-level firmware/boot-stage component responsible for initiating the operating system and enforcing early-stage security policies. The vulnerability stems from CWE-807 (Reliance on Untrusted Inputs in a Security Decision), a design flaw where the boot loader fails to validate or trust critical security decision inputs before enforcement. This allows an authorized local user with high privileges (PR:H in CVSS) to influence boot-time security mechanisms by providing crafted or malicious input that the loader incorrectly accepts as legitimate. The boot stage executes with maximum system privileges before normal OS protections are active, making this attack surface particularly sensitive. The local attack vector and high-privilege requirement suggest the attacker already has administrative or system-level access, but the vulnerability permits them to circumvent additional security boundaries (such as Secure Boot or other firmware-level protections) that would normally restrict their capabilities.