GRUB2 (BFS filesystem parser): Integer overflow in the BeFS parser leads to heap corruption

Impact

Integer overflow in the BeFS parser leads to heap corruption. Nobody runs BFS in production, which is exactly the point: GRUB compiles in filesystem modules you will never mount, and each one is reachable from an attacker-supplied disk image.

Who can reach it

Attacker-supplied filesystem image on a disk or virtual media the node will parse.

What to do

grub2 package update + reboot. The structural fix is to build GRUB with only the filesystem modules you actually boot from - it deletes a whole recurring CVE class from your fleet.

References

Related entries

• GRUB2 (BFS filesystem parser): Integer overflow producing a heap out-of-bounds read in the BeFS parserCVE-2024-45779 · GRUB2 (BFS filesystem parser)Medium
• GRUB2 (tar filesystem parser): Integer overflow in the tarfs module writes out of boundsCVE-2024-45780 · GRUB2 (tar filesystem parser)Medium
• GRUB2 (UFS filesystem parser): Symlink name length is never validated, giving a heap out-of-bounds write in the UFSCVE-2024-45781 · GRUB2 (UFS filesystem parser)Medium
• Solidigm DC SSDs with TCG Opal (DC P4510/P4511/P4610 Opal, D5-P4320/P4326 Opal, D5-P5316 Opal, D7-P5510/P5520/P5620CVE-2024-47976 · Solidigm DC SSDs with TCG Opal (DC P4510/P4511/P4610 Opal, D5-P4320/P4326 Opal, D5-P5316 Opal, D7-P5510/P5520/P5620…Medium
• Dell iDRAC9 / iDRAC10 (path traversal): A high-privileged remote attacker traverses paths on the BMC filesystemCVE-2025-22397 · Dell iDRAC9 / iDRAC10 (path traversal)Medium
• IBM Power Systems host firmware: crafted service-processor command leaks protected registersCVE-2026-19321 · IBM Power Systems host firmware (service processor register access path)Medium