CVE-2022-3775

2022-12-1900:00:00

CWE-787

redhat

www.cve.org

grub2

font code

out-of-bounds write

memory corruption

unicode sequences

memory availability

cve-2022-3775

8.4 High

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

5.1%

JSON

When rendering certain unicode sequences, grub2’s font code doesn’t proper validate if the informed glyph’s width and height is constrained within bitmap size. As consequence an attacker can craft an input which will lead to a out-of-bounds write into grub2’s heap, leading to memory corruption and availability issues. Although complex, arbitrary code execution could not be discarded.

CNA Affected

[
  {
    "vendor": "n/a",
    "product": "grub2",
    "versions": [
      {
        "version": "All up to 2.06",
        "status": "affected"
      }
    ]
  }
]