CVE-2022-2601

A buffer overflow was found in grub_font_construct_glyph(). A malicious crafted pf2 font can lead to an overflow when calculating the max_glyph_size value, allocating a smaller than needed buffer for the glyph, this further leads to a buffer overflow and a heap based out-of-bounds write. An attacker may use this vulnerability to circumvent the secure boot mechanism.

• CWE-122
• CWE-122
• CWE-787

• https://bugzilla.redhat.com/show_bug.cgi?id=2112975#c0Issue Tracking, Third Party Advisory
• https://security.gentoo.org/glsa/202311-14
• https://security.netapp.com/advisory/ntap-20230203-0004/
• https://arstechnica.com/security/2024/08/a-patch-microsoft-spent-2-years-preparing-is-making-a-mess-for-some-linux-users/
• https://bugzilla.redhat.com/show_bug.cgi?id=2112975#c0Issue Tracking, Third Party Advisory
• https://security.gentoo.org/glsa/202311-14
• https://security.netapp.com/advisory/ntap-20230203-0004/

Published

Dec 14, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-25999Uncontrolled search path element in the Intel(R) Enpirion(R)…7.8
• CVE-2022-2600The Auto-hyperlink URLs WordPress plugin through 5.4.1 does …5.4
• CVE-2022-26002A stack-based buffer overflow vulnerability exists in the co…7.2
• CVE-2022-26006Improper input validation in the BIOS firmware for some Inte…6.7
• CVE-2022-26007An OS command injection vulnerability exists in the console …7.2
• CVE-2022-26009A stack-based buffer overflow vulnerability exists in the co…9.8
• CVE-2022-26013Delta Electronics DIAEnergie (All versions prior to 1.8.02.0…9.8
• CVE-2022-26017Improper access control in the Intel(R) DSA software for bef…8
• CVE-2022-26019Improper access control vulnerability in pfSense CE and pfSe…8.8
• CVE-2022-2602io_uring UAF, Unix SCM garbage collection7
• CVE-2022-26020An information disclosure vulnerability exists in the router…6.5
• CVE-2022-26022Omron CX-Position (versions 2.5.3 and prior) is vulnerable t…7.8