Heap Out-of-Bounds Write Vulnerability in GRUB2 by Red Hat

CVE-2021-3696

What is CVE-2021-3696?

This vulnerability involves a heap out-of-bounds write that can occur during the processing of Huffman tables in the PNG reader of GRUB2. When exploited, it may lead to data corruption in the heap space. Although the impact on confidentiality, integrity, and availability is typically considered low due to the complexity involved in controlling the encoding and arrangement of corrupted Huffman entries for achieving outcomes like arbitrary code execution, this still poses a security risk for users of affected GRUB2 versions.

References