EUVD-2026-44315
GHSA-h2wp-qqpw-35j4
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Local access with low privileges is required to tamper with boot components; integrity is the sole impact as no data is exposed and availability is unaffected.
Primary rating from Vendor (microsoft).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
Missing cryptographic step in Windows Boot Loader allows an authorized attacker to bypass a security feature locally.
AnalysisAI
Windows Boot Loader across Windows 10, Windows 11, and Windows Server 2012 through 2025 omits a required cryptographic integrity step (CWE-325), enabling a locally authenticated attacker to bypass boot-time security features. The CVSS vector (AV:L/PR:L) confirms exploitation requires an existing local foothold - remote unauthenticated attacks are not possible. No active exploitation is recorded (SSVC: none, EPSS 0.23%), but SSVC rates technical impact as total, reflecting that a successful boot-level security bypass can undermine the entire trusted boot chain and enable persistent pre-OS compromise.
Technical ContextAI
CWE-325 (Missing Required Cryptographic Step) identifies vulnerabilities where a mandatory cryptographic operation - such as signature verification, hash validation, or chain-of-trust attestation - is absent or skipped. In the Windows boot process, winload.exe and bootmgr are the trust anchors responsible for verifying the integrity of boot components before handing control to the OS kernel. Omitting a cryptographic check here can allow unsigned or tampered boot components to load, undermining Secure Boot, UEFI signature enforcement, or Windows Measured Boot attestation. CPE data (cpe:2.3:a:microsoft:windows_10_version_1809 through windows_11_version_26h1 and windows_server_2012 through windows_server_2025) confirms the flaw spans both client and server SKUs, including Server Core installations, across a wide range of build generations from 6.2.x to 10.0.28000.x.
RemediationAI
Apply Microsoft's security update for all affected Windows releases via Windows Update, WSUS, or Microsoft Update Catalog, targeting the minimum fixed builds confirmed by EUVD-2026-44315: Windows 10 22H2 to build 10.0.19045.7548, Windows 10 21H2 to 10.0.19044.7548, Windows 10 1809 and Windows Server 2019 to 10.0.17763.9020, Windows 11 24H2 and 25H2 to 10.0.26100.8875, Windows 11 26H1 to 10.0.28000.2525, Windows Server 2025 to 10.0.26100.33158, Windows Server 2022 to 10.0.20348.5386, Windows Server 2016 to 10.0.14393.9339, Windows Server 2012 R2 to 6.3.9600.23291, and Windows Server 2012 to 6.2.9200.26226. The vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-58638 is the authoritative source for update packages. Where immediate patching is not feasible, restrict local interactive and remote logon rights to the minimum necessary set of users to raise the bar for exploitation (CVSS PR:L requires an authenticated session); note this does not eliminate the flaw. Enabling Virtualization-Based Security (VBS) and Credential Guard provides an additional integrity layer but does not compensate for the missing boot loader cryptographic step directly.
More in Windows 10 Version 1809
View allRemote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen
Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p
Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a n
Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-leve
Local privilege escalation in the Windows Kernel lets an already-authenticated attacker corrupt kernel memory via a use-
Local code execution in the Windows DHCP Client service stems from a use-after-free (CWE-416) memory-corruption flaw aff
Remote code execution in the Microsoft Windows DHCP Server role allows an unauthenticated network attacker to run arbitr
Local code execution in the Windows Media component of supported Windows 10, Windows 11, and Windows Server (2016 throug
Local privilege escalation via heap-based buffer overflow in the Windows Message Queuing (MSMQ) Queue Manager component
Local privilege escalation in Microsoft Windows Win32K lets an authenticated low-privileged user corrupt kernel heap mem
Local privilege escalation in the Windows NTFS file system driver lets an authenticated low-privileged user win a race c
Elevation of privilege in the Windows Hyper-V virtual network switch (VMSwitch) lets an authenticated attacker operating
Same weakness CWE-325 – Missing Cryptographic Step
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today