Skip to main content
MEDIUM

CVE-2020-15707

CVSS v3

6.4

MEDIUM

EPSS Score

1.6 %

exploit probability, as of 2026-10-19

CISA KEV

No

known exploited

Exploitation

—

SSVC status

Get an alert for each new CVE published for grub2.

Set up CVE WatchFree account · no credit card

Affected and fixed versions

Packages from OSV.dev and products from the vendors' CSAF advisories.

version not verifiedVersions not verified: read as OSV.dev and the vendors publish them, not checked against each vendor's release list.

Vendor advisories

  • CVE-2020-15707 Red Hat Product Security1,229 products fixed

    grub2: Integer overflow in initrd size handling

  • ICSA-21-336-06 CISA3 known affected

    Hitachi Energy APM Edge

    APM Edge: Version 3.0 · APM Edge: Version 2.0 · APM Edge: Version 1.0

  • RHSA-2020:3274 Red Hat Product Security93 products fixed

    Red Hat Security Advisory: grub2 security and bug fix update

  • RHSA-2020:3276 Red Hat Product Security153 products fixed

    Red Hat Security Advisory: grub2 security and bug fix update

  • RHSA-2020:3271 Red Hat Product Security104 products fixed

    Red Hat Security Advisory: grub2 security and bug fix update

  • RHSA-2020:3275 Red Hat Product Security115 products fixed

    Red Hat Security Advisory: grub2 security and bug fix update

4 more advisories

Full record on NVD

Description

Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian, Red Hat, and Ubuntu (the functionality is not included in GRUB2 upstream), leading to a heap-based buffer overflow. These could be triggered by an extremely large number of arguments to the initrd command on 32-bit architectures, or a crafted filesystem with very large files on any architecture. An attacker could use this to execute arbitrary code and bypass UEFI Secure Boot restrictions. This issue affects GRUB2 version 2.04 and prior versions.

Technical details

Published
2020-07-29

Frequently asked questions

What is CVE-2020-15707?

Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian, Red Hat, and Ubuntu (the functionality is not included in GRUB2 upstream), leading to a heap-based buffer overflow. These could be triggered by an extremely large number of arguments to the initrd command on 32-bit architectures, or a crafted filesystem with very large files on any architecture. An attacker could use this to execute arbitrary code and bypass UEFI Secure Boot restrictions. This issue affects GRUB2 version 2.04 and prior versions.

Is CVE-2020-15707 actively exploited?

Active exploitation of CVE-2020-15707 has not been confirmed. Its EPSS score was 1.6% on 2026-10-19, the estimated probability of exploitation in the next 30 days.

What is the CVSS score for CVE-2020-15707?

CVE-2020-15707 has a CVSS v3 base score of 6.4 (MEDIUM severity).

Running grub2? Hear about its next vulnerability

CVE Watch matches each new CVE to the vendors and products you list (vendor and product, not the version) and puts it in your alerts with its KEV and EPSS status.

Get alerts for this productCISA KEV additions, October 2026Search CVEs

Already have an account? Open CVE WatchNo credit card required · No monthly cap on website lookups · 250 API requests/month

Go further

Related vulnerabilities

Same product first, then the same vendor advisory and the same publication week.

Back to CVE Database