CVE-2024-45782

HighCVSS 7.8/10Last modified Oct 21, 2026

Description

A flaw was found in the HFS filesystem. When reading an HFS volume's name at grub_fs_mount(), the HFS filesystem driver performs a strcpy() using the user-provided volume name as input without properly validating the volume name's length. This issue may read to a heap-based out-of-bounds writer, impacting grub's sensitive data integrity and eventually leading to a secure boot protection bypass.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published: Mar 3, 2025
Last modified: Oct 21, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-457834.4A flaw was found in grub2. When failing to mount an HFS+ grub, the hfsplus filesystem driver doesn't properly set an ERRNO value. This issue CVE-2024-457847.5Apache Airflow versions before 2.10.3 contain a vulnerability that could expose sensitive configuration variables in task logs. This vulnera CVE-2024-457857.5MUSASI version 3 contains an issue with use of client-side authentication. If this vulnerability is exploited, other users' credential and s CVE-2024-457866.5This vulnerability exists in Reedos aiM-Star version 2.0.1 due to improper access controls on its certain API endpoints. An authenticated re CVE-2024-457876.5This vulnerability exists in Reedos aiM-Star version 2.0.1 due to transmission of sensitive information in plain text in certain API endpoin CVE-2024-457887.5This vulnerability exists in Reedos aiM-Star version 2.0.1 due to missing rate limiting on OTP requests in certain API endpoints. An authent CVE-2024-457894.3This vulnerability exists in Reedos aiM-Star version 2.0.1 due to improper validation of the ‘mode’ parameter in the API endpoint used durin CVE-2024-457909.8This vulnerability exists in Reedos aiM-Star version 2.0.1 due to missing restrictions for excessive failed authentication attempts on its A CVE-2024-457917.5Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache HertzBeat. This issue affects Apache HertzBeat: before 1 CVE-2024-457926.5Mantis Bug Tracker (MantisBT) is an open source issue tracker. Using a crafted POST request, an unprivileged, registered user is able to ret CVE-2024-457934.8Confidant is a open source secret management service that provides user-friendly storage and access to secrets. The following endpoints are CVE-2024-457948.8devtron is an open source tool integration platform for Kubernetes. In affected versions an authenticated user (with minimum permission) cou