Skip to main content

Grub2 CVE-2025-61662

HIGH
Use After Free (CWE-416)
2025-11-18 secalert@redhat.com
Denial Of Service Memory Corruption Use After Free Grub2
7.8
CVSS 3.1 · Vendor: redhat
Share

Severity by source

Vendor (redhat) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
SUSE
HIGH
qualitative
Red Hat
7.8 MEDIUM
qualitative

Primary rating from Vendor (redhat).

CVSS VectorVendor: redhat

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
Re-analysis Queued
Apr 16, 2026 - 11:22 vuln.today
cvss_changed
Analysis Generated
Mar 17, 2026 - 20:45 vuln.today
Patch released
Mar 17, 2026 - 20:45 nvd
Patch available
CVE Published
Nov 18, 2025 - 19:15 nvd
HIGH 7.8

DescriptionCVE.org

A Use-After-Free vulnerability has been discovered in GRUB's gettext module. This flaw stems from a programming error where the gettext command remains registered in memory after its module is unloaded. An attacker can exploit this condition by invoking the orphaned command, causing the application to access a memory location that is no longer valid. An attacker could exploit this vulnerability to cause grub to crash, leading to a Denial of Service. Possible data integrity or confidentiality compromise is not discarded.

AnalysisAI

A use-after-free vulnerability exists in GRUB's gettext module where the gettext command remains registered after module unloading, allowing attackers with local access and low privileges to trigger memory corruption. Successful exploitation can lead to denial of service through GRUB crashes and potentially compromise system confidentiality and integrity. With an EPSS score of only 0.01%, real-world exploitation is currently unlikely, and patches are available from Red Hat and other vendors.

Technical ContextAI

The vulnerability affects GNU GRUB2 bootloader (cpe:2.3:a:gnu:grub2:*:*:*:*:*:*:*:*) in its gettext internationalization module, which handles language translation functionality. The root cause is a classic use-after-free condition (CWE-416) where the gettext command registration persists in memory after the containing module is unloaded, creating a dangling pointer. When the orphaned command is subsequently invoked, GRUB attempts to execute code from freed memory regions, resulting in unpredictable behavior ranging from crashes to potential arbitrary code execution within the bootloader context.

RemediationAI

Apply vendor-supplied patches immediately, with Red Hat patches available through multiple RHSA advisories (RHSA-2026:4648, RHSA-2026:4649, RHSA-2026:4652, RHSA-2026:4653, RHSA-2026:4654, RHSA-2026:4760, RHSA-2026:4830). The patch is also available from the upstream GRUB project as referenced in the oss-security mailing list. Until patching is complete, limit local access to trusted users only and monitor for unusual GRUB module loading/unloading activities. Organizations should prioritize patching based on the criticality of affected systems and existing access controls.

More in Grub2

View all
CVE-2015-8370 HIGH POC
7.4 Dec 16

Multiple integer underflows in Grub2 1.98 through 2.02 allow physically proximate attackers to bypass authentication, ob
CVE-2023-4692 HIGH POC
7.8 Oct 25

An out-of-bounds write flaw was found in grub2's NTFS filesystem driver. Rated high severity (CVSS 7.8), this vulnerabil
CVE-2024-2312 MEDIUM POC
6.7 Apr 05

GRUB2 does not call the module fini functions on exit, leading to Debian/Ubuntu's peimage GRUB2 module leaving UEFI syst
CVE-2020-15707 MEDIUM POC
6.4 Jul 29

Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRU
CVE-2024-56737 HIGH
8.8 Dec 29

GNU GRUB (aka GRUB2) through 2.12 has a heap-based buffer overflow in fs/hfs.c via crafted sblock data in an HFS filesys
CVE-2022-2601 HIGH
8.6 Dec 14

A buffer overflow was found in grub_font_construct_glyph(). Rated high severity (CVSS 8.6), this vulnerability is no aut
CVE-2023-4693 MEDIUM POC
4.6 Oct 25

An out-of-bounds read flaw was found on grub2's NTFS filesystem driver. Rated medium severity (CVSS 4.6), this vulnerabi
CVE-2021-20233 HIGH
8.2 Mar 03

A flaw was found in grub2 in versions prior to 2.06. Rated high severity (CVSS 8.2), this vulnerability is low attack co
CVE-2020-10713 HIGH
8.2 Jul 30

A flaw was found in grub2, prior to version 2.06. Rated high severity (CVSS 8.2), this vulnerability is low attack compl
CVE-2025-0678 HIGH
7.8 Mar 03

A flaw was found in grub2. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch

CVE-2024-45782 HIGH
7.8 Mar 03

A flaw was found in the HFS filesystem. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No

CVE-2025-1125 HIGH
7.8 Mar 03

When reading data from a hfs filesystem, grub's hfs filesystem module uses user-controlled parameters from the filesyste

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
Container suse/manager/5.0/x86_64/server:5.0.6.7.36.2 Affected
Container suse/multi-linux-manager/5.1/x86_64/server:5.1.1.1.8.10.2 Image server-image Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-4.14 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.53 Affected
Container suse/sle-micro-rancher/5.2:latest Affected
Container suse/sle-micro-rancher/5.3:latest Container suse/sle-micro-rancher/5.4:5.4.4.5.96 Image SLES15-SP4-BYOS-Azure Image SLES15-SP4-BYOS-GCE Image SLES15-SP4-HPC-BYOS-Azure Image SLES15-SP4-HPC-BYOS-GCE Image SLES15-SP4-HPC-GCE Image SLES15-SP4-Hardened-BYOS-Azure Image SLES15-SP4-Hardened-BYOS-GCE Image SLES15-SP4-Manager-Server-4-3-BYOS Image SLES15-SP4-Manager-Server-4-3-BYOS-Azure Image SLES15-SP4-Manager-Server-4-3-BYOS-GCE Image SLES15-SP4-SAP-Azure Image SLES15-SP4-SAP-Azure-LI-BYOS Image SLES15-SP4-SAP-Azure-LI-BYOS-Production Image SLES15-SP4-SAP-Azure-VLI-BYOS Image SLES15-SP4-SAP-Azure-VLI-BYOS-Production Image SLES15-SP4-SAP-BYOS-Azure Image SLES15-SP4-SAP-BYOS-GCE Image SLES15-SP4-SAP-GCE Image SLES15-SP4-SAP-Hardened Image SLES15-SP4-SAP-Hardened-Azure Image SLES15-SP4-SAP-Hardened-BYOS-Azure Image SLES15-SP4-SAP-Hardened-BYOS-GCE Image SLES15-SP4-SAP-Hardened-GCE Image SLES15-SP4-SAPCAL-Azure Image SLES15-SP4-SAPCAL-GCE Affected

Share

CVE-2025-61662 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy