An out-of-bounds read flaw was found on grub2's NTFS filesystem driver. This issue may allow a physically present attacker to present a specially crafted NTFS file system image to read arbitrary memory locations. A successful attack allows sensitive data cached in memory or EFI variable values to be leaked, presenting a high Confidentiality risk.
CVE-2023-4693
CVSS base score
5.3 (v3.1)
Severity
MEDIUM
Attack vector
Local
Weakness
CWE-125
Last modified
November 2, 2026
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N
Affected products
gnu grub2
redhat enterprise linux
References
- access.redhat.com
- access.redhat.com
- access.redhat.com Third Party Advisory
- bugzilla.redhat.com Issue Tracking, Third Party Advisory
- dfir.ru Exploit, Third Party Advisory
- lists.gnu.org Mailing List
- seclists.org Mailing List, Third Party Advisory
- access.redhat.com
- access.redhat.com
- access.redhat.com Third Party Advisory