CVE-2020-14310

There is an issue on grub2 before version 2.06 at function read_section_as_string(). It expects a font name to be at max UINT32_MAX - 1 length in bytes but it doesn't verify it before proceed with buffer allocation to read the value from the font value. An attacker may leverage that by crafting a malicious font file which has a name with UINT32_MAX, leading to read_section_as_string() to an arithmetic overflow, zero-sized allocation and further heap-based buffer overflow.

• CWE-122
• CWE-190
• CWE-190

• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00016.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00017.htmlMailing List, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14310Issue Tracking, Vendor Advisory
• https://security.gentoo.org/glsa/202104-05Third Party Advisory
• https://usn.ubuntu.com/4432-1/Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00016.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00017.htmlMailing List, Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14310Issue Tracking, Vendor Advisory
• https://security.gentoo.org/glsa/202104-05Third Party Advisory
• https://usn.ubuntu.com/4432-1/Third Party Advisory

Published

Jul 31, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-14305An out-of-bounds memory write flaw was found in how the Linu…8.1
• CVE-2020-14306An incorrect access control flaw was found in the operator, …8.8
• CVE-2020-14307A vulnerability was found in Wildfly's Enterprise Java Beans…6.5
• CVE-2020-14308In grub2 versions before 2.06 the grub memory allocator does…6.4
• CVE-2020-14309There's an issue with grub2 in all versions before 2.06 when…6.7
• CVE-2020-1431An elevation of privilege vulnerability exists when the Wind…7.8
• CVE-2020-14311There is an issue with grub2 before version 2.06 while handl…6
• CVE-2020-14312A flaw was found in the default configuration of dnsmasq, as…5.9
• CVE-2020-14313An information disclosure vulnerability was found in Red Hat…4.3
• CVE-2020-14314A memory out-of-bounds read flaw was found in the Linux kern…5.5
• CVE-2020-14315A memory corruption vulnerability is present in bspatch as s…9.8
• CVE-2020-14316A flaw was found in kubevirt 0.29 and earlier. Virtual Machi…9.9