Code execution via ReiserFS symlink integer overflow

Heap buffer overflow in GNU GRUB 2.12 and earlier allows local users to execute arbitrary code via a crafted ReiserFS symlink. The reiserfs module derives allocation sizes from attacker-controlled filesystem geometry without correctly rejecting integer overflow, so grub_malloc allocates an undersized buffer before grub_reiserfs_read_real writes the overflowed length. Exploitation requires high local privileges and a crafted ReiserFS filesystem that GRUB reads while resolving a symlink; successful exploitation can bypass Secure Boot protections.