high 7.1

CVE-2022-3775 json

When rendering certain unicode sequences, grub2's font code doesn't proper validate if the informed glyph's width and height is constrained…

published 2022-12-19 3 y ago modified 2026-06-17 4 mo ago also EUVD-2022-43125

cvss: 7.1; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 1.0%; EPSS 1.0% chance of exploitation in 30 days, percentile 64%
public exploits: 0; none known

When rendering certain unicode sequences, grub2's font code doesn't proper validate if the informed glyph's width and height is constrained within bitmap size. As consequence an attacker can craft an input which will lead to a out-of-bounds write into grub2's heap, leading to memory corruption and availability issues. Although complex, arbitrary code execution could not be discarded.

Patch / fix

distros 8

debian ubuntu red hat suse opensuse almalinux rocky linux azure linux

grub2 Debian 14, Debian 13, Debian 12 2.06-5

debian advisories DEBIAN-CVE-2022-3775

grub2-signed Ubuntu 18.04 LTS 1.187.3~18.04.1
grub2-signed Ubuntu 20.04 LTS 1.187.3~20.04.1
grub2-signed Ubuntu 22.04 LTS 1.187.3~22.04.1
grub2-unsigned Ubuntu 18.04 LTS 2.06-2ubuntu14.1
grub2-unsigned Ubuntu 22.04 LTS, Ubuntu 20.04 LTS 2.06-2ubuntu14

ubuntu advisories UBUNTU-CVE-2022-3775

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

grub2 RHEL 9 1:2.06-46.el9_1.3
grub2-pc RHEL 9 1:2.06-46.el9_1.3
grub2-tools RHEL 9 1:2.06-46.el9_1.3
grub2-common RHEL 9 1:2.06-46.el9_1.3
grub2-efi-x64 RHEL 9 1:2.06-46.el9_1.3
grub2-ppc64le RHEL 9 1:2.06-46.el9_1.3
grub2-efi-aa64 RHEL 9 1:2.06-46.el9_1.3
grub2-tools-efi RHEL 9 1:2.06-46.el9_1.3

red hat advisories RHSA-2023:0752 RHSA-2023:0049 RHSA-2023:0047 RHSA-2023:0048 RHSA-2022:8978 RHSA-2022:8800

grub2 SLE Micro 5.1 2.04-150300.3.8.1
grub2 SLES for SAP 12 SP5, SLES for SAP 12 SP4, SLES 12 SP5 +3 more 2.02-153.1
grub2 SLE Module for Server Applications 15 SP3, SLE Module for Basesystem 15 SP3, SLE Micro 5.2 +3 more 2.04-150300.22.25.1
grub2 SLES for SAP 15 SP2, SLES 15 SP2-LTSS, SLES 15 SP2-BCL +6 more 2.04-150200.9.68.1
grub2 SLES 12 SP2-BCL 2.02-115.72.1
grub2 SLES 12 SP3-BCL 2.02-142.1
grub2 SLES for SAP 15 SP1, SLES 15 SP1-LTSS, SLES 15 SP1-BCL +3 more 2.02-150100.123.17.1
grub2 SLE Module for Server Applications 15 SP4, SLE Module for Basesystem 15 SP4, SLE Micro 5.3 +3 more 2.06-150400.11.17.1

suse advisories SUSE-SU-2023:1701-1 SUSE-SU-2022:4302-1 SUSE-SU-2022:4219-1 SUSE-SU-2022:4218-1 SUSE-SU-2022:4144-1 SUSE-SU-2022:4143-1

grub2 openSUSE Tumbleweed 2.06-31.1

opensuse advisories openSUSE-SU-2024:12517-1

grub2-pc AlmaLinux 9 1:2.06-46.el9_1.3.alma
grub2-tools AlmaLinux 9 1:2.06-46.el9_1.3.alma
grub2-common AlmaLinux 9 1:2.06-46.el9_1.3.alma
grub2-efi-x64 AlmaLinux 9 1:2.06-46.el9_1.3.alma
grub2-ppc64le AlmaLinux 9 1:2.06-46.el9_1.3.alma
grub2-efi-aa64 AlmaLinux 9 1:2.06-46.el9_1.3.alma
grub2-tools-efi AlmaLinux 9 1:2.06-46.el9_1.3.alma
grub2-pc-modules AlmaLinux 9 1:2.06-46.el9_1.3.alma

almalinux advisories ALSA-2023:0752 ALSA-2023:0049

grub2 Rocky Linux 9 1:2.06-46.el9_1.3.rocky.0.2
grub2 Rocky Linux 8 1:2.02-142.el8_7.1.rocky.0.2

rocky linux advisories RLSA-2023:0752 RLSA-2023:0049

grub2 CBL-Mariner 2.0 2.06-10
grub2 Azure Linux 3.0 2.06-14

azure linux advisories AZL-12079 AZL-34792

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2022-3775 updated 2026-11-05 cvss 7.1

grub2: Heap based out-of-bounds write when redering certain unicode sequences

Red Hat Enterprise Linux 7 grub2, grub2-pc, grub2-efi, grub2-ppc64, grub2-tools, grub2-common, +15 more
affected: no fix planned “Out of support scope”
Red Hat Enterprise Linux BaseOS (v. 8) grub2 2.02-142.el8_7.1, grub2-pc 2.02-142.el8_7.1, grub2-tools 2.02-142.el8_7.1, grub2-common 2.02-142.el8_7.1, grub2-efi-x64 2.02-142.el8_7.1, grub2-ppc64le 2.02-142.el8_7.1, +13 more
fixed: vendor fix RHSA-2023:0049
Red Hat Enterprise Linux BaseOS (v. 9) grub2 2.06-46.el9_1.3, grub2-pc 2.06-46.el9_1.3, grub2-tools 2.06-46.el9_1.3, grub2-common 2.06-46.el9_1.3, grub2-efi-x64 2.06-46.el9_1.3, grub2-ppc64le 2.06-46.el9_1.3, +10 more
fixed: vendor fix RHSA-2023:0752
Red Hat Enterprise Linux BaseOS AUS (v. 8.2) grub2 2.02-87.el8_2.11, grub2-pc 2.02-87.el8_2.11, grub2-tools 2.02-87.el8_2.11, grub2-common 2.02-87.el8_2.11, grub2-efi-x64 2.02-87.el8_2.11, grub2-efi-ia32 2.02-87.el8_2.11, +10 more
fixed: vendor fix RHSA-2022:8800
Red Hat Enterprise Linux BaseOS E4S (v. 8.1) grub2 2.02-87.el8_1.11, grub2-pc 2.02-87.el8_1.11, grub2-tools 2.02-87.el8_1.11, grub2-common 2.02-87.el8_1.11, grub2-efi-x64 2.02-87.el8_1.11, grub2-ppc64le 2.02-87.el8_1.11, +11 more
fixed: vendor fix RHSA-2022:8494
Red Hat Enterprise Linux BaseOS E4S (v. 8.2) grub2 2.02-87.el8_2.11, grub2-pc 2.02-87.el8_2.11, grub2-tools 2.02-87.el8_2.11, grub2-common 2.02-87.el8_2.11, grub2-efi-x64 2.02-87.el8_2.11, grub2-ppc64le 2.02-87.el8_2.11, +11 more
fixed: vendor fix RHSA-2022:8800
Red Hat Enterprise Linux BaseOS EUS (v.8.4) grub2 2.02-99.el8_4.10, grub2-pc 2.02-99.el8_4.10, grub2-tools 2.02-99.el8_4.10, grub2-common 2.02-99.el8_4.10, grub2-efi-x64 2.02-99.el8_4.10, grub2-ppc64le 2.02-99.el8_4.10, +13 more
fixed: vendor fix RHSA-2023:0047
Red Hat Enterprise Linux BaseOS EUS (v.8.6) grub2 2.02-123.el8_6.12, grub2-pc 2.02-123.el8_6.12, grub2-tools 2.02-123.el8_6.12, grub2-common 2.02-123.el8_6.12, grub2-efi-x64 2.02-123.el8_6.12, grub2-ppc64le 2.02-123.el8_6.12, +13 more
fixed: vendor fix RHSA-2023:0048

show 2 more

Red Hat Enterprise Linux BaseOS EUS (v.9.0) grub2 2.06-27.el9_0.12, grub2-pc 2.06-27.el9_0.12, grub2-tools 2.06-27.el9_0.12, grub2-common 2.06-27.el9_0.12, grub2-efi-x64 2.06-27.el9_0.12, grub2-ppc64le 2.06-27.el9_0.12, +10 more
fixed: vendor fix RHSA-2022:8978
Red Hat Enterprise Linux BaseOS TUS (v. 8.2) grub2 2.02-87.el8_2.11, grub2-pc 2.02-87.el8_2.11, grub2-tools 2.02-87.el8_2.11, grub2-common 2.02-87.el8_2.11, grub2-efi-x64 2.02-87.el8_2.11, grub2-efi-ia32 2.02-87.el8_2.11, +10 more
fixed: vendor fix RHSA-2022:8800

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 5 mo ago (2026-05-27)

Exploit prediction

1.04% chance of exploitation in the next 30 days, higher than 64% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	7.1	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
NVD	3.1	7.1	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
CNA	3.1	7.1	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Affected products

n/a grub2

Classification

Weakness

CWE-787 Out-of-bounds Write

References

security.gentoo.org /glsa/202311-14
vendor-advisory
access.redhat.com /security/cve/cve-2022-3775
third-party-advisory

Sources

CVE List CVE-2022-3775
NVD CVE-2022-3775

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary