GHSA-8h84-vmjf-pcmj

GHSA-8h84-vmjf-pcmj PUBLISHED CVSS 7.099999904632568 HIGH

Record from GitHub Advisory Database · Published December 19, 2022

When rendering certain unicode sequences, grub2's font code doesn't proper validate if the informed glyph's width and height is constrained within bitmap size. As consequence an attacker can craft an input which will lead to a out-of-bounds write into grub2's heap, leading to memory corruption and availability issues. Although complex, arbitrary code execution could not be discarded.

Risk scores

CVSS 3.1

7.099999904632568

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Timeline

Dec 19, 2022 CVE Published
May 1, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-8h84-vmjf-pcmj
vulnetix vdb fixes GHSA-8h84-vmjf-pcmj

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-8h84-vmjf-pcmj/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →