Microsoft's Secure Boot Flaw: A Decade of Vulnerability Exposed

Microsoft's Secure Boot mechanism, intended to prevent firmware infections on Windows and Linux devices, has been found to have a critical flaw that persisted for 13 of its 14 years. Security researchers identified 11 firmware images, known as shims, that were signed by Microsoft despite containing known vulnerabilities. These shims, used to extend Secure Boot to Linux and utility software, were not revoked by Microsoft even after defects were discovered.

This oversight enabled attackers to easily bypass the protection embedded in a device's motherboard firmware. The vulnerability is not due to a novel exploit, but rather the use of old, still-trusted, yet unrevoked shim binaries. This allows for the installation of malicious firmware that loads early in the boot process, persisting even after an operating system is reinstalled or a hard drive is replaced. The threat extends to both Windows and Linux users.

While Microsoft typically revokes vulnerable shims, it failed to do so for these 11 images for over a decade. The company only revoked them in its June 2026 monthly patch release after ESET brought the issue to light. The complexity of the Secure Boot system, involving multiple databases and revocation methods like SBAT and Secure Boot SVN, may have contributed to this prolonged lapse. Experts suggest this situation is a significant rebuke of the Secure Boot model itself.