Skip to content
OpenAdvisories
High MSRC-CVE-2023-24932 1 CVE

Secure Boot Security Feature Bypass Vulnerability

Published May 9, 2023 · Updated Jul 10, 2025 · Revision 9

Vendor: Microsoft

Summary

Impact: Security Feature Bypass. Microsoft rating: Important. Exploited according to Microsoft, publicly disclosed before the fix — Exploitation Detected. Customer action: Required.

Details

According to the CVSS metric, privileges required is high (PR:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to compromise admin credentials on the device.

How can an attacker successfully exploit this vulnerability?
To exploit the vulnerability, an attacker who has physical access or Administrative rights to a target device could install an affected boot policy.

What kind of security feature could be bypassed by successfully exploiting this vulnerability?
An attacker who successfully exploited this vulnerability could bypass Secure Boot.

Are there additional steps I need to take to be protected from this vulnerability?
The security update addresses the vulnerability by updating the Windows Boot Manager, but is not enabled by default. Additional steps are required at this time to mitigate the vulnerability. Please refer to the following for steps to determine impact on your environment: KB5025885: How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932.

I am running Window 11 23H2 or Server 2022, 23H2 Edition, What do I need to do to be protected from this vulnerability?
Protections for the Secure Boot bypass were included in Windows 11 Version 23H3 and Windows Server 2022, 23H2 Edition at the time of their release; however, these protections are not enabled by default. Customers running these versions of Windows must enable the protections as outlined in KB5025885: How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932.

Security updates
10.0.26100.4652 — https://support.microsoft.com/help/5062553
10.0.17763.7558 — https://support.microsoft.com/help/5062557
10.0.17763.6054 — https://support.microsoft.com/help/5040430
10.0.20348.3932 — https://support.microsoft.com/help/5062572
10.0.19042.2965 — https://support.microsoft.com/help/5026361
10.0.22000.3079 — https://support.microsoft.com/help/5040431
10.0.19044.6093 — https://support.microsoft.com/help/5062554
10.0.22621.5624 — https://support.microsoft.com/help/5062552
10.0.25398.1732 — https://support.microsoft.com/help/5062570
10.0.10240.21073 — https://support.microsoft.com/help/5062561
10.0.14393.8246 — https://support.microsoft.com/help/5062560
6.0.6003.23418 — https://support.microsoft.com/help/5062624
6.0.6003.23418 — https://support.microsoft.com/help/5062618
6.1.7601.27820 — https://support.microsoft.com/help/5062632
6.1.7601.27820 — https://support.microsoft.com/help/5062619
6.2.9200.25573 — https://support.microsoft.com/help/5062592
6.3.9600.22676 — https://support.microsoft.com/help/5062597

Vulnerabilities 1

Revision history

  1. #9

    Microsoft has released July 8, 2025 security updates for all supported versions of Windows that provide new mitigations to protect against this vulnerability; however, these mitigations are not enabled by default. After you have installed the updates, follow the steps outlined in [KB5025885: How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932](https://support.microsoft.com/help/5025885) to enable these protections. All Windows devices should have the the July 8, 2025 security updates installed regardless of your plan to enable the mitigations.

  2. #8

    The following updates have been made to CVE-2023-24932: 1) In the Security Updates table, added all supported versions of the following as they are affected by this vulnerability: Windows 11 24H2 and Windows Server 2025. 2) Further, to comprehensively address this vulnerability, Microsoft has released February 2025 security updates for all affected versions of Windows 11 version 22H2 and Windows 11 version 23H2. Microsoft recommends that customers install the updates to be fully protected from the vulnerability. Customers whose systems are configured to receive automatic updates do not need to take any further action.

  3. #7

    Updated the Security Updates table to include the July 9, 2024 updates. These updates include support for opting into an updated Secure Version Number to block older boot managers.

  4. #6

    In the Security Updates table, added Windows 11 version 23H2 for x64-based systems and Windows 11 version 23H2 for ARM-based systems because the April 2024 security updates provide the latest mitigations. Note that these mitigations are off by default. Customers who should take additional steps to implement security mitigations for a publicly disclosed Secure Boot bypass leveraged by the BlackLotus UEFI bootkit and who would like to take a proactive security stance or to begin preparing for the rollout, please refer to [KB5025885: How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932 - Microsoft Support](https://support.microsoft.com/help/5025885).

  5. #5

    Updated FAQs to include information on how to be protected from this vulnerability for customers running Windows 11 23H2 or Windows Server 2022, 23H2 Edition. This is an informational change only.

  6. #4

    Removed the Security Hotpatch Update for the July 2023 revision as that package doesn't exist for this release cycle. You must install the Security Update to get the updated software.

  7. #3

    CORRECTED REVISION: To comprehensively address CVE-2023-24932, Microsoft has released July 2023 security updates for all affected versions of Microsoft Windows. Microsoft strongly recommends that customers install the updates to be fully protected from the vulnerability. Additional steps are required after the update is installed. See [KB5025885: How to manage the Windows Boot Manager revocations for Secure Boot changes associated with CVE-2023-24932](https://support.microsoft.com/help/5025885) for more information.

  8. #2

    In the Security Updates table, added all supported versions of all supported versions of .NET Framework, Visual Studio 2022 version 17.0, Visual Studio 2022 version 17.2, and Visual Studio 2022 version 17.4 because these products are also affected by this vulnerability. Microsoft strongly recommends that customers running any of these products install the updates to be fully protected from the vulnerability. Customers whose systems are configured to receive automatic updates do not need to take any further action.

  9. #1

    Information published.

References