CVE-2026-25250

🕷️ CVE-2026-25250：可信引导加载程序链验证不当 一个由 Microsoft 签名的第三方引导加载程序，加载了无签名或完整性验证的二级 EFI 二进制文件，从内部瓦解了 Secure Boot 信任链。 📑 目录 研究背景 官方参考 自行复现 受影响引导链 漏洞概述 📂 Secure Boot 与信任模型 根本原因分析 利用过程 缓解与吊销 🧠 研究背景 本仓库记录了针对 CVE-2026-25250 的研究，这是一个已向 Microsoft 披露并于 2026 年 4 月分配 CVE 编号的 Secure Boot...

shim: 3rd party shim allow secure boot bypass

A flaw was found in Eurosoft bootloaders before 2022-06-01. An attacker may use this bootloader to bypass or tamper with Secure Boot protections. In order to load and execute arbitrary code in the pre-boot stage, an attacker simply needs to replace the existing signed bootloader currently in use...

SUSE CVE-2022-34301

A flaw was found in CryptoPro Secure Disk bootloaders before 2022-06-01. An attacker may use this bootloader to bypass or tamper with Secure Boot protections. In order to load and execute arbitrary code in the pre-boot stage, an attacker simply needs to replace the existing signed bootloader...

CVE-2022-34302

A flaw was found in New Horizon Datasys bootloaders before 2022-06-01. An attacker may use this bootloader to bypass or tamper with Secure Boot protections. In order to load and execute arbitrary code in the pre-boot stage, an attacker simply needs to replace the existing signed bootloader...

Input validation

A flaw was found in CryptoPro Secure Disk bootloaders before 2022-06-01. An attacker may use this bootloader to bypass or tamper with Secure Boot protections. In order to load and execute arbitrary code in the pre-boot stage, an attacker simply needs to replace the existing signed bootloader...

PT-2022-4307 · Microsoft +3 · Windows +3

Name of the Vulnerable Software and Affected Versions: Eurosoft bootloaders versions prior to 2022-06-01 Description: A flaw was found in Eurosoft bootloaders that allows an attacker to bypass or tamper with Secure Boot protections. To load and execute arbitrary code in the pre-boot stage, an...