CVE-2026-97876Medium· 6.4▾ SunlitA local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enabled. The vulnerability is caused …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot and load an unsigned GRUB module, while GRUB continues to report lockdown is enabled.
The vulnerability is caused by insufficient validation of the MMIO base address passed to the GRUB serial command. GRUB does not validate that the base address corresponds to a UART device, rather than being an arbitrary memory address. This allows an attacker to trick GRUB into writing non-arbitrary data at an attacker-controlled address, including resetting the grub_file_verifiers list in a way that disables the subsequent verification of loaded modules.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2023-4693Medium· 5.3An out-of-bounds read flaw was found on grub2's NTFS filesystem driver
CVE-2023-4692High· 7.5An out-of-bounds write flaw was found in grub2's NTFS filesystem driver
CVE-2025-61662High· 7.8A Use-After-Free vulnerability has been discovered in GRUB's gettext module
CVE-2024-45782High· 7.8A flaw was found in the HFS filesystem
CVE-2024-45778Medium· 4.1A stack overflow flaw was found when reading a BFS file system
CVE-2025-1125High· 7.8When reading data from a hfs filesystem, grub's hfs filesystem module uses user-controlled parameters from the filesystem metadata to calculate the internal buffers size, however it misses to properly check for integer overflows