What’s Vulnerable › Products
grub2 vulnerabilities
54 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 20 published in the last 12 months.
Check whether your grub2 version is affected
Latest grub2 vulnerabilities
- CVE-2026-97876 — Bypass of GRUB lockdown restriction in Secure Boot mode via serial command MMIO base address (CVSS 6.4)
- CVE-2025-61664 — Grub2: missing unregister call for normal_exit command may lead to use-after-free (CVSS 4.9)
- CVE-2025-61663 — Grub2: missing unregister call for normal commands may lead to use-after-free (CVSS 4.9)
- CVE-2025-61662 — Grub2: missing unregister call for gettext command may lead to use-after-free (CVSS 7.8)
- CVE-2025-61661 — Grub2: grub2: out-of-bounds write via malicious usb device (CVSS 4.8)
- CVE-2025-54771 — Grub2: use-after-free in grub_file_close() (CVSS 4.9)
- CVE-2025-54770 — Grub2: use-after-free in net_set_vlan (CVSS 4.9)
- CVE-2025-0686 — Grub2: romfs: integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading dat (CVSS 6.4)
- CVE-2025-0685 — Grub2: jfs: integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading data (CVSS 6.4)
- CVE-2025-0684 — Grub2: reiserfs: integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading data (CVSS 6.4)
- CVE-2025-0678 — Grub2: squash4: integer overflow may lead to heap based out-of-bounds write when reading data (CVSS 7.8)
- CVE-2024-45782 — Grub2: fs/hfs: strcpy() using the volume name (fs/hfs.c:382) (CVSS 7.8)
- CVE-2024-45778 — Grub2: fs/bfs: integer overflow in the bfs parser. (CVSS 5.5)
- CVE-2025-1125 — Grub2: fs/hfs: integer overflow may lead to heap based out-of-bounds write (CVSS 7.8)
- CVE-2025-0689 — Grub2: udf: heap based buffer overflow in grub_udf_read_block() may lead to arbitrary code execution (CVSS 7.8)
- CVE-2024-45780 — Grub2: fs/tar: integer overflow causes heap oob write (CVSS 6.7)
- CVE-2024-45779 — Grub2: fs/bfs: integer overflow leads to heap oob read in the bfs parser (CVSS 6.0)
- CVE-2024-45777 — Grub2: grub-core/gettext: integer overflow leads to heap oob write. (CVSS 6.7)
- CVE-2024-56738 — (CVSS 5.3)
- CVE-2024-56737 — (CVSS 8.8)
- CVE-2024-2312 — (CVSS 6.7)
- CVE-2024-1048 — Grub2: grub2-set-bootflag can be abused by local (pseudo-)users (CVSS 3.3)
- CVE-2023-4001 — Grub2: bypass the grub password protection feature (CVSS 6.8)
- CVE-2023-4693 — Grub2: out-of-bounds read at fs/ntfs.c (CVSS 4.6)
- CVE-2023-4692 — Grub2: out-of-bounds write at fs/ntfs.c may lead to unsigned code execution (CVSS 7.8)