CVE-2021-3696: gnu grub2 Out-of-bounds Write
Vulnerability summary
CVE-2021-3696 is a medium (CVSS 6.9) Out-of-bounds Write vulnerability in gnu grub2. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 39.6% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 16 · Related 11Timeline
- 06-07-2022PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
A heap out-of-bounds write may heppen during the handling of Huffman tables in the PNG reader. This may lead to data corruption in the heap space. Confidentiality, Integrity and Availablity impact may be considered Low as it's very complex to an attacker control the encoding and positioning of corrupted Huffman entries to achieve results such as arbitrary code execution and/or secure boot circumvention. This flaw affects grub2 versions prior grub-2.12.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · DebianEcosystem advisory · calculated4.5MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
- NVDNIST4.5MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
EPSS trend
Probability
0.47%
Chance of exploitation in the next 30 days
Percentile
40%
Versus all other CVEs
30-day change
0.00 pp
From 0.47% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat11 products
- codeready_linux_builderna
- developer_tools1.0
- enterprise_linux8.0 | 8.1 | 8.4 | 9.0
- enterprise_linux_eus8.2 | 8.4 | 8.6 | 9.0
- enterprise_linux_for_power_little_endian8.0 | 9.0
Ubuntu2 products
- grub2-signedAll versions (No fix recorded) | < 1.187.3~18.04.1 | < 1.187.3~20.04.1 | < 1.187.3~22.04.1
- grub2-unsignedAll versions (No fix recorded) | < 2.06-2ubuntu14.1
Debian1 product
- grub2< 2.06-3
Gnu1 product
- grub2≥ 2.00, < 2.12
Netapp1 product
5 vendors · 16 products
