diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
index 088fa26e0d..3f80441602 100644
--- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
+++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
@@ -2933,7 +2933,7 @@ SecureBootExtractConfigFromVariable (
   //
   // Fix Pk, SecureBootEnable inconsistence
   //
-  if ((*SetupMode) == USER_MODE) {
+  if ((SetupMode != NULL) && (*SetupMode) == USER_MODE) {
     ConfigData->HideSecureBoot = FALSE;
     if ((SecureBootEnable != NULL) && (*SecureBootEnable == SECURE_BOOT_ENABLE)) {
       ConfigData->AttemptSecureBoot = TRUE;