CVE-2020-14309: GNU GRUB2

Medium severity, CVSS 6.7. EPSS: 0.5% chance of exploitation in the next 30 days.

There's an issue with grub2 in all versions before 2.06 when handling squashfs filesystems containing a symbolic link with name length of UINT32 bytes in size. The name size leads to an arithmetic overflow leading to a zero-size allocation further causing a heap-based buffer overflow with attacker controlled data.

Affected products

• GNU GRUB2: before 2.06 (fixed in 2.06)
• Opensuse Leap: version 15.1 only; version 15.2 only

Published 2020-07-30. Last modified 2026-06-17.