Description
A crafted 16-bit grayscale PNG image may lead to a out-of-bounds write in the heap area. An attacker may take advantage of that to cause heap data corruption or eventually arbitrary code execution and circumvent secure boot protections. This issue has a high complexity to be exploited as an attacker needs to perform some triage over the heap layout to achieve signifcant results, also the values written into the memory are repeated three times in a row making difficult to produce valid payloads. This flaw affects grub2 versions prior grub-2.12.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | grub2 | grub-2.06 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | grub2 | 2.06-3 | — |
| Debian 13 | grub2 | 2.06-3 | — |
| Debian 12 | grub2 | 2.06-3 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | grub2-signed | 1.187.3~22.04.1 | USN-6355-1 |
| Ubuntu 22.04 LTS | grub2-unsigned | 2.06-2ubuntu14.1 | USN-6355-1 |
| Ubuntu 22.04 LTS | shim | 15.7-0ubuntu1 | USN-6355-1 |
| Ubuntu 22.04 LTS | shim-signed | 1.51.3 | USN-6355-1 |
| Ubuntu 20.04 LTS | grub2-signed | 1.187.3~20.04.1 | USN-6355-1 |
| Ubuntu 20.04 LTS | grub2-unsigned | 2.06-2ubuntu14.1 | USN-6355-1 |
| Ubuntu 20.04 LTS | shim | 15.7-0ubuntu1 | USN-6355-1 |
| Ubuntu 20.04 LTS | shim-signed | 1.40.9 | USN-6355-1 |
| Ubuntu 18.04 LTS | grub2-signed | 1.187.3~18.04.1 | — |
| Ubuntu 18.04 LTS | grub2-unsigned | 2.06-2ubuntu14.1 | — |
| Ubuntu 16.04 LTS | grub2-signed +1 | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 14.04 LTS | grub2-signed | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | grub2 +15 | 1:2.06-27.el9_0.7 | RHSA-2022:5099 |
| RHEL 9 | shim +3 | 15.6-1.el9 | RHSA-2022:5099 |
| RHEL 8 | grub2 +18 | 1:2.02-123.el8_6.8 | RHSA-2022:5095 |
| RHEL 8 | shim +4 | 15.6-1.el8 | RHSA-2022:5095 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8.4 EUS | grub2 +18 | 1:2.02-99.el8_4.9 | RHSA-2022:5096 |
| RHEL 8.4 EUS | shim +4 | 15.6-1.el8 | RHSA-2022:5096 |
| RHEL 8.2 EUS | grub2 +18 | 1:2.02-87.el8_2.10 | RHSA-2022:5100 |
| RHEL 8.2 EUS | shim +4 | 15.6-1.el8 | RHSA-2022:5100 |
| RHEL 8.1 E4S | grub2 +16 | 1:2.02-87.el8_1.10 | RHSA-2022:5098 |
| RHEL 8.1 E4S | shim +2 | 15.6-1.el8 | RHSA-2022:5098 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | grub2-pc +14 | 1:2.06-27.el9_0.7.alma | ALSA-2022:5099 |
| AlmaLinux 9 | shim-x64 +2 | 15.6-1.el9.alma | ALSA-2022:5099 |
| AlmaLinux 8 | grub2-pc +16 | 1:2.02-123.el8_6.8.alma | ALSA-2022:5095 |
| AlmaLinux 8 | shim-x64 +3 | 15.6-1.el8.alma | ALSA-2022:5095 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | mokutil | 2:0.4.0-8.el9_0.1 | RLSA-2022:5099 |
| Rocky Linux 9 | shim | 15.6-1.el9 | RLSA-2022:5099 |
| Rocky Linux 8 | grub2 | 1:2.02-123.el8_6.8 | RLSA-2022:5095 |
| Rocky Linux 8 | mokutil | 1:0.3.0-11.el8_6.1 | RLSA-2022:5095 |
| Rocky Linux 8 | shim +1 | 15.6-1.el8 | RLSA-2022:5095 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | grub2 | 2.06-150400.11.5.2 | SUSE-SU-2022:2035-1 |
| SLES 15 SP3 | grub2 | 2.04-150300.22.20.2 | SUSE-SU-2022:2064-1 |
| SLES 15 SP2 | grub2 | 2.04-150200.9.63.2 | SUSE-SU-2022:2074-1 |
| SLES 15 SP1 | grub2 | 2.02-150100.123.12.2 | SUSE-SU-2022:2041-1 |
| SLES 15 | grub2 | 2.02-150000.122.12.2 | SUSE-SU-2022:2036-1 |
Show 27 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP5 | grub2 | 2.02-143.2 | SUSE-SU-2022:2038-1 |
| SLES 12 SP4 | grub2 | 2.02-143.2 | SUSE-SU-2022:2038-1 |
| SLES 12 SP3 | grub2 | 2.02-137.2 | SUSE-SU-2022:2037-1 |
| SLES 12 SP2 | grub2 | 2.02-115.67.2 | SUSE-SU-2022:2039-1 |
| SLES for SAP 15 SP2 | grub2 | 2.04-150200.9.63.2 | SUSE-SU-2022:2074-1 |
| SLES for SAP 15 SP1 | grub2 | 2.02-150100.123.12.2 | SUSE-SU-2022:2041-1 |
| SLES for SAP 15 | grub2 | 2.02-150000.122.12.2 | SUSE-SU-2022:2036-1 |
| SLES for SAP 12 SP5 | grub2 | 2.02-143.2 | SUSE-SU-2022:2038-1 |
| SLES for SAP 12 SP4 | grub2 | 2.02-143.2 | SUSE-SU-2022:2038-1 |
| SLES for SAP 12 SP3 | grub2 | 2.02-137.2 | SUSE-SU-2022:2037-1 |
| SLE Micro 5.2 | grub2 | 2.04-150300.22.20.2 | SUSE-SU-2022:2064-1 |
| SLE Micro 5.1 | grub2 | 2.04-150300.3.5.1 | SUSE-SU-2022:2073-1 |
| SLE HPC 15 SP2 | grub2 | 2.04-150200.9.63.2 | SUSE-SU-2022:2074-1 |
| SLE HPC 15 SP1 | grub2 | 2.02-150100.123.12.2 | SUSE-SU-2022:2041-1 |
| SLE HPC 15 | grub2 | 2.02-150000.122.12.2 | SUSE-SU-2022:2036-1 |
| SUSE OpenStack Cloud Crowbar 9 | grub2 | 2.02-143.2 | SUSE-SU-2022:2038-1 |
| SUSE OpenStack Cloud Crowbar 8 | grub2 | 2.02-137.2 | SUSE-SU-2022:2037-1 |
| SUSE OpenStack Cloud 9 | grub2 | 2.02-143.2 | SUSE-SU-2022:2038-1 |
| SUSE OpenStack Cloud 8 | grub2 | 2.02-137.2 | SUSE-SU-2022:2037-1 |
| SUSE Manager Server 4.1 | grub2 | 2.04-150200.9.63.2 | SUSE-SU-2022:2074-1 |
| SUSE Manager Retail Branch Server 4.1 | grub2 | 2.04-150200.9.63.2 | SUSE-SU-2022:2074-1 |
| SUSE Manager Proxy Module 4.3 | grub2 | 2.06-150400.11.5.2 | SUSE-SU-2022:2035-1 |
| SUSE Manager Proxy Module 4.2 | grub2 | 2.04-150300.22.20.2 | SUSE-SU-2022:2064-1 |
| SUSE Manager Proxy 4.1 | grub2 | 2.04-150200.9.63.2 | SUSE-SU-2022:2074-1 |
| SUSE HPE Helion OpenStack 8 | grub2 | 2.02-137.2 | SUSE-SU-2022:2037-1 |
| SUSE Enterprise Storage 7 | grub2 | 2.04-150200.9.63.2 | SUSE-SU-2022:2074-1 |
| SUSE Enterprise Storage 6 | grub2 | 2.02-150100.123.12.2 | SUSE-SU-2022:2041-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | grub2 | 2.06-25.1 | openSUSE-SU-2024:12137-1 |
| openSUSE Leap 15.4 | grub2 | 2.06-150400.11.5.2 | SUSE-SU-2022:2035-1 |
| openSUSE Leap 15.3 | grub2 | 2.04-150300.22.20.2 | SUSE-SU-2022:2064-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | grub2-pc +16 | 1:2.06-61.amzn2023.0.3 | ALAS2023-2023-020 |
| Amazon Linux 2 | grub2 +17 | 1:2.06-14.amzn2 | ALAS2-2023-2146 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | grub2 | 2.06-14 | — |
| Azure Linux 2 (CBL-Mariner) | grub2 | 2.06-12 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | grub2-pc +12 | 1:2.06-27.0.6.el9_0.7 | ELSA-2022-9596, ELSA-2022-5099 |
| Oracle Linux 9 | kernel-uek +34 | 6.12.0-101.33.4.3.el10uek | ELSA-2025-20530, ELSA-2025-20480 |
| Oracle Linux 8 | grub2-pc +15 | 1:2.02-123.0.3.el8 | ELSA-2022-9595, ELSA-2022-9471, ELSA-2022-5095 |
| Oracle Linux 7 | grub2 +12 | 1:2.02-0.87.0.21.el7_9.9 | ELSA-2023-12952, ELSA-2022-9469 |
| Oracle Linux 7 | grub2-efi-aa64 +2 | 1:2.02-0.87.0.26.el7_9.9 | ELSA-2023-12952 |
Advisories 32
- ALSA-2022:5099 Important: grub2, mokutil, shim, and shim-unsigned-x64 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2022:5095 Important: grub2, mokutil, shim, and shim-unsigned-x64 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2022:5100 Red Hat Security Advisory: grub2, mokutil, shim, and shim-unsigned-x64 security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2022:5099 Red Hat Security Advisory: grub2, mokutil, shim, and shim-unsigned-x64 security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2022:5096 Red Hat Security Advisory: grub2, mokutil, shim, and shim-unsigned-x64 security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2022:5098 Red Hat Security Advisory: grub2, mokutil, and shim security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2022:5095 Red Hat Security Advisory: grub2, mokutil, shim, and shim-unsigned-x64 security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- USN-6355-1 grub2-signed, grub2-unsigned, shim, and shim-signed vulnerability Ubuntu Security Notices (USN) · May 29, 2026
- WID-SEC-2022-0181 Grub2: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Apr 7, 2026
- RLSA-2022:5099 Important: grub2, mokutil, shim, and shim-unsigned-x64 security update Rocky Linux Security Advisories · Feb 5, 2026
- RLSA-2022:5095 Important: grub2, mokutil, shim, and shim-unsigned-x64 security update Rocky Linux Security Advisories · Feb 4, 2026
- SUSE-SU-2022:2064-1 Security update for grub2 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:2039-1 Security update for grub2 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:2037-1 Security update for grub2 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:2073-1 Security update for grub2 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:2074-1 Security update for grub2 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:2035-1 Security update for grub2 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12137-1 grub2-2.06-25.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:2036-1 Security update for grub2 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:2038-1 Security update for grub2 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:2041-1 Security update for grub2 SUSE / openSUSE Security Updates · Feb 4, 2026
- ELSA-2025-20530 Important: Unbreakable Enterprise kernel security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Aug 18, 2025
- ELSA-2025-20480 Important: Unbreakable Enterprise kernel security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jul 17, 2025
- ELSA-2023-12952 Important: grub2 security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Oct 27, 2023
- ALAS2-2023-2146 Important: grub2 security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jul 19, 2023
- ALAS2023-2023-020 Important: grub2 security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 22, 2023
- ELSA-2022-9596 Important: grub2 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jul 14, 2022
- ELSA-2022-9595 Important: grub2 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jul 14, 2022
- ELSA-2022-5095 Important: grub2, mokutil, shim, and shim-unsigned-x64 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jul 4, 2022
- ELSA-2022-5099 Important: grub2 security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 30, 2022
- ELSA-2022-9469 Important: grub2 security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jun 7, 2022
- ELSA-2022-9471 Important: grub2 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jun 7, 2022