{"id":"CVE-2023-4949","aliases":["DEBIAN-CVE-2023-4949","EUVD-2023-54785"],"status":"published","title":"Memory Corruption Vulnerability in Grub-Legacy's XFS Implementation","description":"An attacker with local access to a system (either through a disk or external drive) can present a modified XFS partition to grub-legacy in such a way to exploit a memory corruption in grub’s XFS file system implementation.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00241,"percentile":0.153,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-119","CWE-190","CWE-787"],"published":"2023-11-10T16:57:03Z","modified":"2026-10-26T18:02:50Z","affected":[{"source":"osv","ecosystem":"Debian:12","package":"grub","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.97-80","0.97-81","0.97-82","0.97-83","0.97-84"]},{"source":"osv","ecosystem":"Debian:13","package":"grub","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.97-84"]}],"products":[{"vendor":"free software foundation","product":"grub-legacy"},{"vendor":"gnu","product":"grub"},{"vendor":"xen","product":"xen"}],"references":[{"url":"https://xenbits.xenproject.org/xsa/advisory-443.html","tags":["x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-4949","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-4949","title":"Memory Corruption Vulnerability in Grub-Legacy's XFS Implementation","description":"An attacker with local access to a system (either through a disk or external drive) can present a modified XFS partition to grub-legacy in such a way to exploit a memory corruption in grub’s XFS file system implementation.\n","status":"published","published":"2023-11-10T16:57:03.311Z","modified":"2024-09-03T17:29:10.425Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-119","CWE-190"],"updated_at":"2026-11-02T14:35:30.116696Z"}],"euvd":[{"id":"EUVD-2023-54785","description":"An attacker with local access to a system (either through a disk or external drive) can present a modified XFS partition to grub-legacy in such a way to exploit a memory corruption in grub’s XFS file system implementation.\n","status":"published","published":"2023-11-10T16:57:03Z","modified":"2024-09-03T17:29:10Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H","level":"high"}],"updated_at":"2026-11-03T00:56:05.515988Z"}],"nvd":[{"id":"CVE-2023-4949","description":"An attacker with local access to a system (either through a disk or external drive) can present a modified XFS partition to grub-legacy in such a way to exploit a memory corruption in grub’s XFS file system implementation.\n","status":"published","published":"2023-11-10T17:15:07.57Z","modified":"2026-06-17T06:38:57.99Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-119","CWE-190","CWE-787"],"updated_at":"2026-11-02T14:08:46.647045Z"}],"osv":[{"id":"CVE-2023-4949","description":"An attacker with local access to a system (either through a disk or external drive) can present a modified XFS partition to grub-legacy in such a way to exploit a memory corruption in grub’s XFS file system implementation.\n","status":"published","published":"2023-11-10T17:15:07.57Z","modified":"2026-03-14T12:15:38.56962Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:34.72355Z"},{"id":"DEBIAN-CVE-2023-4949","description":"An attacker with local access to a system (either through a disk or external drive) can present a modified XFS partition to grub-legacy in such a way to exploit a memory corruption in grub’s XFS file system implementation.","status":"published","published":"2023-11-10T17:15:07.57Z","modified":"2026-10-26T18:02:50.900131422Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:40.275853Z"}]}}