CVE-2024-45774 Grub2: reader/jpeg: heap oob write during jpeg parsing
A heap out-of-bounds write in GRUB2's JPEG parser allows attackers to potentially bypass Secure Boot protections via a crafted image.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-45774?
CVE-2024-45774 is a medium-severity memory corruption vulnerability in Red Hat Enterprise Linux 10, published on 18 Feb 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw was found in grub2. A specially crafted JPEG file can cause the JPEG parser of grub2 to incorrectly check the bounds of its internal buffers, resulting in an out-of-bounds write. The possibility of overwriting sensitive information to bypass secure boot protections is not discarded.
Weakness: CWE-787
Which versions are affected by CVE-2024-45774?
How do I fix CVE-2024-45774?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2024-45774 being exploited?
There is no known exploitation of CVE-2024-45774 in the wild and no public exploit code.
Sources
Also known as AZL-56940, AZL-57067, BELL-CVE-2024-45774, DEBIAN-CVE-2024-45774, GHSA-f5v2-rhg6-jmg7, UBUNTU-CVE-2024-45774.