Vulnerable UEFI Shim Bootloaders Undermining Secure Boot

ESET researchers have identified 11 vulnerable UEFI shim bootloaders (version 0.9 and below) signed by Microsoft that undermine the integrity of UEFI Secure Boot. These shims, associated with various Linux distributions and diagnostic tools, can be leveraged by attackers to execute untrusted code during the system boot process. Because these shims are trusted by the Microsoft Corporation UEFI CA 2011, an attacker can "bring their own" vulnerable shim to any UEFI-based machine to bypass security restrictions, regardless of the installed operating system.

The technical core of the threat lies in the shims' reliance on outdated second-stage bootloaders, such as GRUB 2, which contain known vulnerabilities like CVE-2015-5281. Furthermore, older shims lack modern revocation enforcement mechanisms like Secure Boot Advanced Targeting (SBAT) and Machine Owner Key (MOK) denylists (MokListX), allowing attackers to bypass newer security policies. Microsoft revoked these vulnerable binaries in the June 9th, 2026 Patch Tuesday update.

This discovery highlights a significant systemic risk in the UEFI ecosystem: the persistence of signed but vulnerable legacy code. Until these specific hashes are added to a system's DBX revocation list, the platform remains susceptible to UEFI bootkits such as BlackLotus, Bootkitty, and HybridPetya, which can establish high-privilege persistence that is difficult to detect from within the operating system.