GR
Product
grub2
49
CVEs
0
On KEV
8.8
Max CVSS
1
New 30D
Severity mix
Critical 0High 21Medium 26Low 2
Watch
Add grub2 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-56737 | 8.8 | Dec 29 | GNU GRUB (aka GRUB2) through 2.12 has a heap-based buffer overflow in fs/hfs.c via crafted sblock data in an HFS filesystem Affected: 2.00 through 2.12 |
| CVE-2022-2601 | 8.6 | Dec 14 | A buffer overflow was found in grub_font_construct_glyph() Affected: through 2.06 |
| CVE-2021-20233 | 8.2 | Mar 3 | A flaw was found in grub2 in versions prior to 2.06 Affected: before 2.06 |
| CVE-2020-25632 | 8.2 | Mar 3 | A flaw was found in grub2 in versions prior to 2.06 Affected: before 2.06 |
| CVE-2020-10713 | 8.2 | Jul 30 | A flaw was found in grub2, prior to version 2.06 Affected: before 2.06 |
| CVE-2022-28733 | 8.1 | Jul 20 | Integer underflow in grub_net_recv_ip4_packets; A malicious crafted IP packet can lead to an integer underflow in grub_net_recv_ip4_packets() function on rsm->total_len value Affected: 2.00 before 2.06-3 |
| CVE-2025-61662 | 7.8 | Nov 18 | Grub2: missing unregister call for gettext command may lead to use-after-free Affected: through 2.14 |
| CVE-2025-0678 | 7.8 | Mar 3 | Grub2: squash4: integer overflow may lead to heap based out-of-bounds write when reading data Affected: through 2.12 |
| CVE-2024-45782 | 7.8 | Mar 3 | Grub2: fs/hfs: strcpy() using the volume name (fs/hfs.c:382) Affected: through 2.12 |
| CVE-2025-0689 | 7.8 | Mar 3 | Grub2: udf: heap based buffer overflow in grub_udf_read_block() may lead to arbitrary code execution Affected: through 2.12 |
| CVE-2025-1125 | 7.8 | Mar 3 | Grub2: fs/hfs: integer overflow may lead to heap based out-of-bounds write Affected: through 2.12 |
| CVE-2023-4692 | 7.8 | Oct 25 | An out-of-bounds write flaw was found in grub2's NTFS filesystem driver Affected: before 2.12 |
| CVE-2022-28736 | 7.8 | Jul 20 | There's a use-after-free vulnerability in grub_cmd_chainloader() function; The chainloader command is used to boot up operating systems that doesn't support multiboot and do not… Affected: 2.00 before 2.06-3 |
| CVE-2022-28735 | 7.8 | Jul 20 | The GRUB2's shim_lock verifier allows non-kernel files to be loaded on shim-powered secure boot systems Affected: 2.00 before 2.06-3 |
| CVE-2020-25647 | 7.6 | Mar 3 | A flaw was found in grub2 in versions prior to 2.06 Affected: before 2.06 |
| CVE-2020-27779 | 7.5 | Mar 3 | A flaw was found in grub2 in versions prior to 2.06 Affected: before 2.06 |
| CVE-2020-14372 | 7.5 | Mar 3 | A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI command when Secure Boot is enabled Affected: before 2.06 |
| CVE-2015-8370 | 7.4 | Dec 16 | Multiple integer underflows in Grub2 1.98 through 2.02 allow physically proximate attackers to bypass authentication, obtain sensitive information, or cause a denial of service… Affected: 1.98; 1.99; 2.00; 2.01; 2.02 |
| CVE-2022-3775 | 7.1 | Dec 19 | When rendering certain unicode sequences, grub2's font code doesn't proper validate if the informed glyph's width and height is constrained within bitmap size Affected: through 2.06 |
| CVE-2022-28734 | 7.0 | Jul 20 | Out-of-bounds write when handling split HTTP headers; When handling split HTTP headers, GRUB2 HTTP code accidentally moves its internal data buffer point by one position Affected: 2.00 before 2.06-3 |
| CVE-2021-3697 | 7.0 | Jul 6 | A crafted JPEG image may lead the JPEG reader to underflow its data pointer, allowing user-controlled data to be written in heap Affected: 2.00 before 2.12 |
Showing 21