Windows Secure Boot relies on Microsoft certificates stored in the UEFI KEK and DB to validate boot components. The original certificates from 2011 are nearing expiration in 2026, necessitating updates to avoid loss of security fixes related to the Windows boot manager and Secure Boot. The update process depends on firmware components that might contain defects, which can cause certificate trust updates to fail or behave unpredictably, potentially disrupting the Secure Boot trust chain. This vulnerability is identified as CWE-1329, indicating reliance on a component that is not updateable. A patch is available to update these certificates and restore intended security guarantees.

If the certificates are not updated properly, Secure Boot functionality may be compromised, leading to potential loss of security guarantees during system boot. This could allow unauthorized boot loaders or components to be trusted, impacting confidentiality, integrity, and availability of the system. The CVSS score of 6.4 reflects a medium severity with high impact on confidentiality, integrity, and availability, but requiring local access with high privileges and no user interaction.

A patch is available to update the expiring Microsoft certificates used by Windows Secure Boot. It is recommended to apply the official update from Microsoft to ensure Secure Boot functionality is maintained and security fixes are preserved. Careful validation and deployment of the update are necessary due to potential firmware component defects affecting the update process. Administrators should monitor vendor advisories for detailed guidance on applying these updates.