CVE-2024-45778

Grub2: fs/bfs: integer overflow in the bfs parser.

State: Published
Severity: 4.1 Medium
Published: Mar 3, 2025
Updated: Oct 21, 2026
Reserved: Sep 8, 2024

Description

A stack overflow flaw was found when reading a BFS file system. A crafted BFS filesystem may lead to an uncontrolled loop, causing grub2 to crash.

Scores

CVSS	Score	Vector	Source
3.1	4.1 Medium	CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H	redhat

Weaknesses

CWE-190 Integer Overflow or Wraparound

Affected Products

Product	Versions
grub2	2.12 and earlierAffected
Red Hat Enterprise Linux 10Red Hat
Red Hat Enterprise Linux 7Red Hat
Red Hat Enterprise Linux 8Red Hat
Red Hat Enterprise Linux 9Red Hat
Red Hat OpenShift Container Platform 4Red Hat

References

https://access.redhat.com/security/cve/CVE-2024-45778vdb-entry
RHBZ#2345640issue-tracking
https://lists.gnu.org/archive/html/grub-devel/2025-02/msg00024.html

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.