Windows Boot Loader CVE-2026-58638

Exploitation requires an authenticated local session with at least low-level user privileges on the target machine, as confirmed by CVSS AV:L/PR:L - remote unauthenticated exploitation is not possible. The vulnerability affects all patched-out-of-scope builds of the listed Windows versions in their default installation state; no special non-default configuration is required to be vulnerable. Exploitation is further constrained by the need to write to or replace boot loader components, which typically requires elevated filesystem permissions even under PR:L - the exact privilege boundary is not detailed in available data and should be confirmed with the vendor advisory. The attack is non-automatable per SSVC, meaning it cannot be mass-exploited via scripted or worm-style techniques, limiting realistic threat actors to those with targeted, persistent local access.

The CVSS 5.5 Medium score reflects a realistic but constrained threat: local attack vector (AV:L), low complexity (AC:L), low privilege requirement (PR:L), high integrity impact, and no confidentiality or availability impact. EPSS at 0.23% (14th percentile) signals low near-term exploitation probability consistent with SSVC's 'exploitation: none' classification. However, SSVC simultaneously rates technical impact as 'total,' capturing that a successful boot-loader security-feature bypass compromises the entire pre-OS trust chain - a disproportionate consequence relative to the moderate CVSS score. SSVC also marks this as non-automatable, ruling out mass or worm-style exploitation. The realistic risk posture is: low urgency for most environments, but elevated priority for high-security or compliance-sensitive deployments where boot integrity attestation (TPM, Measured Boot, VBS) is a critical control. No KEV listing and no public exploit code further support deferring emergency response in favor of normal patch cycle treatment.

An attacker with a low-privileged local account - obtained via phishing, credential stuffing, or lateral movement - modifies or replaces a boot loader component on the target Windows machine. On the next system reboot, the vulnerable boot loader skips the required cryptographic signature check, allowing the tampered component to execute as trusted pre-OS code, potentially installing a bootkit or disabling endpoint security agents that rely on measured boot attestation. No public exploit code has been identified, so exploitation currently requires attacker knowledge of Windows boot internals and write access to relevant boot components.