CVE-2021-3695

A crafted 16-bit grayscale PNG image may lead to a out-of-bounds write in
the heap area. An attacker may take advantage of that to cause heap data
corruption or eventually arbitrary code execution and circumvent secure
boot protections. This issue has a high complexity to be exploited as an
attacker needs to perform some triage over the heap layout to achieve
signifcant results, also the values written into the memory are repeated
three times in a row making difficult to produce valid payloads. This flaw
affects grub2 versions prior grub-2.12.