EUVD-2026-35525
GHSA-4636-q739-m8jq
Severity by source
AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Lifecycle Timeline
2DescriptionCVE.org
Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.
AnalysisAI
Security feature bypass in Windows Secure Boot allows a high-privileged local attacker to circumvent the boot integrity protection mechanism, undermining trust in the Windows boot chain. The flaw (CWE-1329, reliance on a component that is not updateable) carries a CVSS 7.9 rating due to scope change and high impact on confidentiality and integrity, and no public exploit has been identified at time of analysis. Successful exploitation could enable pre-OS persistence such as bootkits, defeating a foundational Windows security control.
Technical ContextAI
Secure Boot is the UEFI-based firmware feature that validates the cryptographic signatures of bootloaders, drivers, and the OS kernel against keys stored in firmware (PK, KEK, db, dbx) to prevent unauthorized code from running during boot. CWE-1329 (Reliance on Component That is Not Updateable) indicates the failure stems from a component in the boot chain whose trust anchors or validation logic cannot be readily revoked or updated, so an attacker who can influence that component can sidestep signature enforcement. Because Secure Boot underpins downstream defenses like BitLocker measured boot, Device Guard, and Virtualization-Based Security, a bypass here erodes the root of trust those features depend on.
RemediationAI
Patch available per vendor advisory - apply the Microsoft security update referenced at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-48576 as soon as it is published for your Windows edition, prioritizing endpoints with sensitive data, domain controllers, and hosts using BitLocker or VBS. Because Secure Boot fixes commonly require both an OS update and a DBX (forbidden signature) revocation that becomes effective after reboot, verify the DBX update applied successfully (e.g., via mokutil/PowerShell Get-SecureBootUEFI) and reboot the system; note that DBX updates can brick dual-boot configurations or older recovery media signed with revoked certificates, so test recovery media before mass rollout. As compensating controls until patching completes, enforce BitLocker with TPM+PIN to make offline boot tampering visible, restrict local administrator group membership (the PR:H prerequisite), and enable measured-boot/attestation logging through Microsoft Defender for Endpoint or an MDM attestation policy to detect post-boot integrity drift.
More in Windows 10 1607
View allWindows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables
Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker
Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users
Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the
Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne
Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation
Windows Shell contains a protection mechanism failure (CVE-2026-21510, CVSS 8.8) that allows unauthenticated remote atta
In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptograph
Desktop Window Manager (DWM) in Windows contains a type confusion vulnerability (CVE-2026-21519, CVSS 7.8) that enables
Windows Common Log File System Driver contains another use-after-free for local privilege escalation, the latest in a se
Windows Storage contains an elevation of privilege vulnerability through symlink following that allows authorized attack
Windows Ancillary Function Driver for WinSock contains a use-after-free enabling local privilege escalation through a nu
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today