CVE-2026-45656: UEFI Secure Boot Security Feature Bypass Vulnerability

Synopsis

A protection mechanism failure in Windows UEFI Secure Boot allows a locally authenticated attacker to bypass the Secure Boot security feature. The vulnerability is exploited locally and requires only a low-privilege account, with no network access or victim interaction needed. Successful exploitation lets an attacker load unsigned or malicious boot components, undermining the integrity guarantees that Secure Boot provides. Patched-image rebuilds at the listed fix versions are available on HarborGuard for environments running affected Windows versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network path to the target is required.

• AuthenticationRequired

  A low-privilege local account is sufficient; the attacker does not need administrator or system-level credentials to trigger the bypass.

• Victim interactionNot required

  No user action such as clicking a link or opening a file is needed; the attacker can execute the exploit entirely on their own.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special environmental conditions, race windows, or memory-layout requirements on the attacker.

Blast Radius

• Attacker loads unsigned or otherwise untrusted boot components, bypassing the chain-of-trust validation that UEFI Secure Boot enforces at startup.
• Attacker persists malicious code below the operating system layer, making it invisible to OS-level endpoint detection and surviving OS reinstalls.
• Attacker gains full control over system integrity checks, enabling subsequent privilege escalation or installation of a bootkit.
• Confidentiality, integrity, and availability of the host are all fully compromised once Secure Boot enforcement is defeated.