UEFI SHIM Bootloader EUVD-2026-35791

Exploitation requires local access with at least low privileges (CVSS PR:L) sufficient to write to the EFI System Partition or to stage a bootable device, plus the ability to reboot the target; UEFI Secure Boot must be enabled (otherwise the bypass is irrelevant) and one of the specifically listed vulnerable SHIM authenticode hashes (e.g., PC-Doctor Service Center 15/16, WipeDrive 8.0.0-8.1.3, Baramundi up to 2024R1, Abitti 1 1.0.0, Rosa R9/R10, WTGCreator 4.2) must be usable as the first-stage bootloader. Limiting factors: no remote vector (AV:L), no user interaction required once staged (UI:N), and the SBAT revocation list on the target must not already revoke the abused SHIM - fully-patched systems with current SBAT updates from Microsoft/LVFS will refuse the vulnerable binary.

The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects a local, low-privilege attack with full CIA impact - consistent with a Secure Boot bypass where an attacker who can write to the EFI System Partition or stage a signed-but-vulnerable SHIM uses it to load unsigned/revoked code at boot. CISA's SSVC scoring corroborates this: exploitation=none observed, automatable=no, but technical impact=total, meaning the bug is high-severity but unlikely to drive opportunistic mass exploitation. EPSS data was not provided, and there is no KEV listing nor public PoC reported here, so this is best treated as a defense-in-depth / supply-chain Secure Boot hygiene issue rather than an active incident-response priority. One signal worth noting: the description lists vulnerable authenticode hashes but does not specify which lack SBAT versus which fail to validate it - verify per-vendor advisories before assuming uniform behavior across all listed binaries.

An attacker with local low-privileged access (or brief physical access) drops one of the listed vulnerable signed SHIM binaries onto a target's EFI System Partition or onto a bootable USB and reboots; because SBAT is not validated, the SHIM chain-loads an attacker-controlled second-stage bootloader despite Secure Boot being enabled, yielding a pre-OS bootkit with full CIA impact. No public exploit identified at time of analysis, but the technique is well-understood and parallels prior SHIM/SBAT bypasses tracked by CERT/CC.