7.8
High
CVE-2025-61662 A Use-After-Free vulnerability has been discovered in GRUB's gettext module
Description
A Use-After-Free vulnerability has been discovered in GRUB's gettext module. This flaw stems from a programming error where the gettext command remains registered in memory after its module is unloaded. An attacker can exploit this condition by invoking the orphaned command, causing the application to access a memory location that is no longer valid. An attacker could exploit this vulnerability to cause grub to crash, leading to a Denial of Service. Possible data integrity or confidentiality compromise is not discarded.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| GRUB2 2.14 | earliest → 2.14 | No fix stated |
| Red Hat Enterprise Linux 10 | Versions not published | |
| Red Hat Enterprise Linux 7 | Versions not published | |
| Red Hat Enterprise Linux 8 | Versions not published | |
| Red Hat Enterprise Linux 9 | Versions not published | |
| Red Hat OpenShift Container Platform 4 | Versions not published | |
| Red Hat Enterprise Linux 10.0 Extended Update Support | Versions not published | |
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | Versions not published | |
| Red Hat Enterprise Linux 8.2 Advanced Update Support | Versions not published |
Show the 20 other branches Hide the 20 other branches
Other CVEs of GRUB2
The 10 CVEs of GRUB2 →
CVE-2026-97876
A local attacker with control over GRUB's configuration can bypass lockdown restrictions when booting with Secure Boot…
6.4
Medium
CVE-2025-54770
Grub2: use-after-free in net_set_vlan
4.9
Medium
CVE-2025-61664
Grub2: missing unregister call for normal_exit command may lead to use-after-free
4.9
Medium
CVE-2025-61663
Grub2: missing unregister call for normal commands may lead to use-after-free
4.9
Medium