Record status Published
Identifier year (not publication year) 2025
Source publication Feb 19, 2025
Source updated Oct 13, 2026
Imported by cveboard Oct 24, 2026
CNA source text (English) Grub2: net: out-of-bounds write in grub_net_search_config_file()
A flaw was found in grub2. During the network boot process, when trying to search for the configuration file, grub copies data from a user controlled environment variable into an internal buffer using the grub_strcpy() function. During this step, it fails to consider the environment variable length when allocating the internal buffer, resulting in an out-of-bounds write. If correctly exploited, this issue may result in remote code execution through the same network segment grub is searching for the boot information, which can be used to by-pass secure boot protections.
Scoped product and version facts Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
grub2
Vendor Unknown
Product Unknown
Platforms Unknown
Default status unaffected
Package grub2
Package collection https://www.gnu.org/software/grub/
grub2 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 0 affectedsemver Unavailable 2.12 None listed
Red Hat Enterprise Linux 7 Extended Lifecycle Support
Vendor Red Hat
Product Red Hat Enterprise Linux 7 Extended Lifecycle Support
Platforms Unknown
Default status affected
Package grub2
Package collection https://access.redhat.com/downloads/content/package-browser/
Red Hat Enterprise Linux 7 Extended Lifecycle Support · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 1:2.02-0.87.el7_9.15 unaffectedrpm * Unavailable None listed
Red Hat Enterprise Linux 8
Vendor Red Hat
Product Red Hat Enterprise Linux 8
Platforms Unknown
Default status affected
Package grub2
Package collection https://access.redhat.com/downloads/content/package-browser/
Red Hat Enterprise Linux 8 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 1:2.02-162.el8_10 unaffectedrpm * Unavailable None listed
Red Hat Enterprise Linux 8.2 Advanced Update Support
Vendor Red Hat
Product Red Hat Enterprise Linux 8.2 Advanced Update Support
Platforms Unknown
Default status affected
Package grub2
Package collection https://access.redhat.com/downloads/content/package-browser/
Red Hat Enterprise Linux 8.2 Advanced Update Support · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 1:2.02-87.el8_2.13 unaffectedrpm * Unavailable None listed
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
Vendor Red Hat
Product Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
Platforms Unknown
Default status affected
Package grub2
Package collection https://access.redhat.com/downloads/content/package-browser/
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 1:2.02-99.el8_4.12 unaffectedrpm * Unavailable None listed
Red Hat Enterprise Linux 8.4 Telecommunications Update Service
Vendor Red Hat
Product Red Hat Enterprise Linux 8.4 Telecommunications Update Service
Platforms Unknown
Default status affected
Package grub2
Package collection https://access.redhat.com/downloads/content/package-browser/
Red Hat Enterprise Linux 8.4 Telecommunications Update Service · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 1:2.02-99.el8_4.12 unaffectedrpm * Unavailable None listed
Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
Vendor Red Hat
Product Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions
Platforms Unknown
Default status affected
Package grub2
Package collection https://access.redhat.com/downloads/content/package-browser/
Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 1:2.02-99.el8_4.12 unaffectedrpm * Unavailable None listed
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
Vendor Red Hat
Product Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
Platforms Unknown
Default status affected
Package grub2
Package collection https://access.redhat.com/downloads/content/package-browser/
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 1:2.02-123.el8_6.18 unaffectedrpm * Unavailable None listed
Red Hat Enterprise Linux 8.6 Telecommunications Update Service
Vendor Red Hat
Product Red Hat Enterprise Linux 8.6 Telecommunications Update Service
Platforms Unknown
Default status affected
Package grub2
Package collection https://access.redhat.com/downloads/content/package-browser/
Red Hat Enterprise Linux 8.6 Telecommunications Update Service · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 1:2.02-123.el8_6.18 unaffectedrpm * Unavailable None listed
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
Vendor Red Hat
Product Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions
Platforms Unknown
Default status affected
Package grub2
Package collection https://access.redhat.com/downloads/content/package-browser/
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 1:2.02-123.el8_6.18 unaffectedrpm * Unavailable None listed
Red Hat Enterprise Linux 8.8 Extended Update Support
Vendor Red Hat
Product Red Hat Enterprise Linux 8.8 Extended Update Support
Platforms Unknown
Default status affected
Package grub2
Package collection https://access.redhat.com/downloads/content/package-browser/
Red Hat Enterprise Linux 8.8 Extended Update Support · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 1:2.02-152.el8_8.2 unaffectedrpm * Unavailable None listed
Red Hat Enterprise Linux 9
Vendor Red Hat
Product Red Hat Enterprise Linux 9
Platforms Unknown
Default status affected
Package grub2
Package collection https://access.redhat.com/downloads/content/package-browser/
Red Hat Enterprise Linux 9 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 1:2.06-94.el9_5 unaffectedrpm * Unavailable None listed
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
Vendor Red Hat
Product Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
Platforms Unknown
Default status affected
Package grub2
Package collection https://access.redhat.com/downloads/content/package-browser/
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 1:2.06-27.el9_0.22 unaffectedrpm * Unavailable None listed
Red Hat Enterprise Linux 9.2 Extended Update Support
Vendor Red Hat
Product Red Hat Enterprise Linux 9.2 Extended Update Support
Platforms Unknown
Default status affected
Package grub2
Package collection https://access.redhat.com/downloads/content/package-browser/
Red Hat Enterprise Linux 9.2 Extended Update Support · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 1:2.06-61.el9_2.10 unaffectedrpm * Unavailable None listed
Red Hat Enterprise Linux 9.4 Extended Update Support
Vendor Red Hat
Product Red Hat Enterprise Linux 9.4 Extended Update Support
Platforms Unknown
Default status affected
Package grub2
Package collection https://access.redhat.com/downloads/content/package-browser/
Red Hat Enterprise Linux 9.4 Extended Update Support · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 1:2.06-86.el9_4.2 unaffectedrpm * Unavailable None listed
Red Hat OpenShift Container Platform 4.12
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4.12
Platforms Unknown
Default status affected
Package openshift/ose-rhel-coreos-8
Package collection https://catalog.redhat.com/software/containers/
Red Hat OpenShift Container Platform 4.12 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 412.86.202503310142-0 unaffectedrpm * Unavailable None listed
Red Hat OpenShift Container Platform 4.13
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4.13
Platforms Unknown
Default status affected
Package openshift/ose-rhel-coreos-9
Package collection https://catalog.redhat.com/software/containers/
Red Hat OpenShift Container Platform 4.13 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 413.92.202504070146-0 unaffectedrpm * Unavailable None listed
Red Hat OpenShift Container Platform 4.14
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4.14
Platforms Unknown
Default status affected
Package openshift/ose-rhel-coreos-9
Package collection https://catalog.redhat.com/software/containers/
Red Hat OpenShift Container Platform 4.14 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 414.92.202505141057-0 unaffectedrpm * Unavailable None listed
Red Hat OpenShift Container Platform 4.15
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4.15
Platforms Unknown
Default status affected
Package openshift/ose-rhel-coreos-9
Package collection https://catalog.redhat.com/software/containers/
Red Hat OpenShift Container Platform 4.15 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 415.92.202504282058-0 unaffectedrpm * Unavailable None listed
Red Hat OpenShift Container Platform 4.16
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4.16
Platforms Unknown
Default status affected
Package openshift/ose-rhel-coreos-9
Package collection https://catalog.redhat.com/software/containers/
Red Hat OpenShift Container Platform 4.16 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 416.94.202503252048-0 unaffectedrpm * Unavailable None listed
Red Hat OpenShift Container Platform 4.17
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4.17
Platforms Unknown
Default status affected
Package openshift/ose-rhel-coreos-9
Package collection https://catalog.redhat.com/software/containers/
Red Hat OpenShift Container Platform 4.17 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 417.94.202503241418-0 unaffectedrpm * Unavailable None listed
Red Hat OpenShift Container Platform 4.18
Vendor Red Hat
Product Red Hat OpenShift Container Platform 4.18
Platforms Unknown
Default status affected
Package openshift/ose-rhel-coreos-9
Package collection https://catalog.redhat.com/software/containers/
Red Hat OpenShift Container Platform 4.18 · Scoped product and version facts Version (version) Status (status) Version scheme (versionType) Exclusive end (lessThan) Inclusive end (lessThanOrEqual) Status changes (at → status) 418.94.202504021150-0 unaffectedrpm * Unavailable None listed
Red Hat Enterprise Linux 10
Vendor Red Hat
Product Red Hat Enterprise Linux 10
Platforms Unknown
Default status unaffected
Package grub2
Package collection https://access.redhat.com/downloads/content/package-browser/
No explicit version tuples; consult this entry's default status.