CVE-2024-45780: gnu grub2 Out-of-bounds Write
Vulnerability summary
CVE-2024-45780 is a medium (CVSS 6.7) Out-of-bounds Write vulnerability in gnu grub2. EPSS estimates a 0.29% chance of exploitation in the next 30 days, higher than 20.3% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 9 · Related 9Timeline
- 03-03-2025PublishedVulnerability first disclosed.
- 29-06-2026Last modifiedVulnerability information updated.
Description
A flaw was found in grub2. When reading tar files, grub2 allocates an internal buffer for the file name. However, it fails to properly verify the allocation against possible integer overflows. It's possible to cause the allocation length to overflow with a crafted tar file, leading to a heap out-of-bounds write. This flaw eventually allows an attacker to circumvent secure boot protections.
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated6.7MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated6.7MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- NVDNIST6.7MediumCVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.29%
Chance of exploitation in the next 30 days
Percentile
20%
Versus all other CVEs
30-day change
+0.01 pp
From 0.28% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu3 products
- grub2All versions (No fix recorded)
- grub2-signedAll versions (No fix recorded)
- grub2-unsignedAll versions (No fix recorded)
Debian1 product
- grub2< 2.06-13+deb12u2 | < 2.12-6
Gnu1 product
- grub2≤ 2.12
3 vendors · 5 products
