CVE-2009-4128: GNU Grub 2

High severity, CVSS 7.2. EPSS: 0.6% chance of exploitation in the next 30 days.

GNU GRand Unified Bootloader (GRUB) 2 1.97 only compares the submitted portion of a password with the actual password, which makes it easier for physically proximate attackers to conduct brute force attacks and bypass authentication by submitting a password whose length is 1.

Affected products

• GNU Grub 2: version 1.97 only

Published 2009-12-01. Last modified 2026-06-16.