Microsoft-signed UEFI shims dating back several years contain vulnerabilities that permit attackers to circumvent Secure Boot protections on systems relying on these firmware components. Researchers identified 11 distinct applications, all bearing legitimate Microsoft signatures, that fail to properly validate code during the boot process.

The attack surface stems from insufficient validation checks in these older shim binaries. An attacker who gains write access to the EFI System Partition (ESP) can inject malicious code that these vulnerable shims execute without verification. This execution occurs before the operating system loads, giving attackers complete system control before standard security mechanisms activate.

The threat applies broadly across Linux distributions and systems using UEFI firmware. Most modern systems rely on Secure Boot to ensure only authorized code executes during firmware initialization. These vulnerable shims, signed by Microsoft during earlier development cycles, bypass that protection entirely when exploited.

An attacker exploiting these vulnerabilities can deploy UEFI bootkits that persist across operating system reinstalls and remain invisible to standard antimalware tools. Malicious firmware modifications grant attackers persistence that survives even complete disk formatting, making remediation difficult.

The vulnerability requires local access or the ability to modify the EFI partition, limiting the immediate threat to systems already compromised or physically accessible. However, the presence of these signed applications on millions of systems creates a persistent attack vector for sophisticated threat actors pursuing advanced persistence mechanisms.

Mitigation requires either removing affected shims from systems or waiting for patched versions signed by Microsoft. System administrators should audit which UEFI applications are present on production systems and evaluate whether each serves a necessary function. Disabling unnecessary shims reduces attack surface. Organizations should also ensure firmware updates from vendors include signed patches addressing these validation flaws.

The discovery underscores how legacy code signed with high-level permissions can become security liabilities when vulnerabilities surface