Microsoft released patches Tuesday for a vulnerability that allows attackers to bypass Secure Boot protections on most modern computers, but a second exploit targeting a different firmware remains unaddressed, leaving millions of devices potentially vulnerable to bootkit malware.
The software giant fixed CVE-2025-3052 as part of its June Patch Tuesday by adding 14 compromised module hashes to Secure Boot's revocation database, according to security firm Binarly. The flaw affects nearly every system that trusts Microsoft's "UEFI CA 2011" certificate, which includes most hardware supporting Secure Boot protections.
The patched vulnerability stems from a legitimate BIOS update utility signed with Microsoft's widely-trusted certificate that reads user-writable memory without validation1. Attackers with administrative access can exploit this to disable Secure Boot entirely, clearing the path for bootkit malware that operates before the operating system loads.
"By setting it to zero, we effectively disable Secure Boot, allowing the execution of any unsigned UEFI modules," Binarly explained in its technical analysis1. The vulnerable module has circulated undetected since late 2022, according to BleepingComputer1.
Binarly researcher Alex Matrosov discovered the flaw and reported it to CERT/CC in February1. During Microsoft's investigation, the company determined the issue affected 13 additional modules beyond the original finding1.
While Microsoft addressed CVE-2025-3052, another Secure Boot bypass dubbed "Hydroph0bia" continues to threaten systems running Insyde H2O firmware1. Security researcher Nikolaj Schlej disclosed CVE-2025-4275 Tuesday, though Insyde patched the vulnerability 90 days after disclosure1.
The Hydroph0bia flaw affects UEFI-compatible firmware based on Insyde's H2O platform, representing a separate attack vector from the Microsoft-patched vulnerability1.
Tuesday's patches continue a troubling pattern of Secure Boot compromises. Earlier this year, Microsoft fixed CVE-2024-7344, present in multiple system recovery tools1. In 2022, researchers revealed that over 200 device models from major manufacturers used compromised cryptographic keys, with some using test keys marked "DO NOT SHIP"23.
Security Week reported that the patched flaw was part of a larger Patch Tuesday addressing 66 vulnerabilities, including nine critical-severity flaws with remote code execution capabilities4.
"If the key will be leaked, it's impacting the ecosystem. It's not impacting a single device," Matrosov told Tom's Hardware in reference to previous Secure Boot compromises2.
Microsoft and Binarly urged immediate installation of the updated revocation database to protect against the newly patched exploit5.
