CVE-2023-4692High· 7.5▾ TwilightAn out-of-bounds write flaw was found in grub2's NTFS filesystem driver. This issue may allow an attacker to present a specially crafted NTFS filesystem image, leading to grub's heap metadata corruption. In some circumstances, the attack…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 21.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.5%
0.5% → 0.5%
An out-of-bounds write flaw was found in grub2's NTFS filesystem driver. This issue may allow an attacker to present a specially crafted NTFS filesystem image, leading to grub's heap metadata corruption. In some circumstances, the attack may also corrupt the UEFI firmware heap metadata. As a result, arbitrary code execution and secure boot protection bypass may be achieved.
grub2 < 2.12enterprise_linux = 8.0enterprise_linux = 9.0Upgrade past the affected range:
grub2 2.12Connected by shared product, vendor, weakness, or advisory.
CVE-2023-4693Medium· 5.3An out-of-bounds read flaw was found on grub2's NTFS filesystem driver
CVE-2024-45782High· 7.8A flaw was found in the HFS filesystem
CVE-2026-6846High· 7.8A flaw was found in binutils
CVE-2025-1125High· 7.8When reading data from a hfs filesystem, grub's hfs filesystem module uses user-controlled parameters from the filesystem metadata to calculate the internal buffers size, however it misses to properly check for integer overflows
CVE-2024-45780Medium· 6.7A flaw was found in grub2
CVE-2024-45777Medium· 6.7A flaw was found in grub2