Critical UEFI Secure Boot Bypass Vulnerability Discovered

ESET researchers disclosed CVE-2024-7344, a vulnerability in multiple vendor-signed UEFI recovery applications that permits bypassing UEFI Secure Boot by using a custom PE loader to load unsigned UEFI binaries. The flaw enables execution of untrusted code in the early boot phase, risking persistent platform compromise; the issue was coordinated with CERT/CC and mitigated through Microsoft DBX revocations, and administrators are advised to update the UEFI Forbidden Signature Database.