CVE-2021-3696

Severity: medium (CVSS 4.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-07-06 · updated 2026-06-17
Weakness: CWE-787

Description

A heap out-of-bounds write may heppen during the handling of Huffman tables in the PNG reader. This may lead to data corruption in the heap space. Confidentiality, Integrity and Availablity impact may be considered Low as it's very complex to an attacker control the encoding and positioning of corrupted Huffman entries to achieve results such as arbitrary code execution and/or secure boot circumvention. This flaw affects grub2 versions prior grub-2.12.

Affected products

grub2: from 2.00 before 2.12 — fixed in 2.12
NetApp ONTAP Select Deploy administration utility: all versions
RedHat Codeready Linux Builder: all versions
RedHat Developer Tools: 1.0
Red Hat Enterprise Linux: 8.0, 8.1, 8.4, 9.0
RedHat Enterprise Linux Eus: 8.2, 8.4, 8.6, 9.0
RedHat Enterprise Linux For Power Little Endian: 8.0, 9.0
RedHat Enterprise Linux For Power Little Endian Eus: 8.2, 8.4, 8.6, 9.0
RedHat Enterprise Linux Server Aus: 8.2, 8.4, 8.6
RedHat Enterprise Linux Server For Power Little Endian Update Services For Sap Solutions: 8.1, 8.2, 8.4, 8.6, 9.0
RedHat Enterprise Linux Server Tus: 8.2, 8.4, 8.6
Openshift: 3.0
Red Hat OpenShift Container Platform 4.18: 4.6, 4.9, 4.10

How to fix

Upgrade to a fixed version: grub2 2.12. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-3696 or the next vulnerability affects your stack