The vulnerability in grub2 arises from an integer overflow during allocation of an internal buffer for file names when processing tar files. The lack of proper verification allows a crafted tar file to trigger an allocation length overflow, resulting in a heap out-of-bounds write. This memory corruption flaw can be leveraged to circumvent secure boot protections. The CVSS 3.1 vector indicates local attack vector with low complexity, requiring high privileges, no user interaction, and impacts confidentiality, integrity, and availability with high severity. The vendor advisory from Red Hat is referenced but does not explicitly state patch availability or remediation details.

Successful exploitation can lead to heap memory corruption, enabling an attacker with local high privileges to bypass secure boot protections. This compromises system integrity and confidentiality and may cause denial of service. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory at https://access.redhat.com/security/cve/CVE-2024-45780 for current remediation guidance. Until an official fix is available, restrict local access to trusted users with high privileges to reduce risk.