GRUB2 (PNG grayscale reader): Out-of-bounds write on the grayscale PNG path

CVSS 5.7CVE-2021-3696Firmware, BMC & network fabriccurated

Impact

Out-of-bounds write on the grayscale PNG path. Same shape as the colour path but a separate code path that the first patch did not cover - relevant if you patched early and stopped.

Who can reach it

Attacker-supplied boot splash image.

What to do

grub2 package update + reboot. Confirm your package version covers this one specifically, not just the headline PNG CVE.

References

https://nvd.nist.gov/vuln/detail/CVE-2021-3696 https://access.redhat.com/security/cve/CVE-2021-3696

Related entries

AMI MegaRAC SPx (BMC web interface, HTTP header handling): CRLF sequences are not neutralised in HTTP headers, soCVE-2023-34472 · AMI MegaRAC SPx (BMC web interface, HTTP header handling)Medium
AMD Secure Processor - cryptographic key usage control: Once an attacker has arbitrary code execution inside the ASPCVE-2024-21981 · AMD Secure Processor - cryptographic key usage controlMedium
Intel TDX: insufficient verification of data authenticity in the ring 0 interface leaks trust-domain dataCVE-2025-31356 · Intel TDX (hypervisor-facing ring 0 interface)Medium
Caliptra Core ROM: TOCTOU in update-reset lets compromised MCU firmware bypass secure boot silentlyCVE-2026-11835 · Caliptra Core ROM (UpdateResetFlow staging-address validation)Medium
Intel processors (indirect branch prediction): Spectre v2: an attacker trains the indirect branch predictor so that aCVE-2017-5715 · Intel processors (indirect branch prediction)Medium
Intel processors (bounds check bypass): Spectre v1: speculative execution past a bounds check lets an attacker readCVE-2017-5753 · Intel processors (bounds check bypass)Medium

All Firmware, BMC & network fabric entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.