CVE-2025-54771

A use-after-free vulnerability has been identified in the GNU GRUB (Grand Unified Bootloader). The flaw occurs because the file-closing process incorrectly retains a memory pointer, leaving an invalid reference to a file system structure. An attacker could exploit this vulnerability to cause grub to crash, leading to a Denial of Service. Possible data integrity or confidentiality compromise is not discarded.

CVSS v3 4.9 MEDIUM

4.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.4 / Impact : 3.4

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2025-54771
https://bugzilla.redhat.com/show_bug.cgi?id=2413823
https://lists.gnu.org/archive/html/grub-devel/2025-11/msg00155.html
http://www.openwall.com/lists/oss-security/2025/11/18/3

Configurations

No configuration.

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de uso después de liberación ha sido identificada en GNU GRUB (Grand Unified Bootloader). El fallo ocurre porque el proceso de cierre de archivos retiene incorrectamente un puntero de memoria, dejando una referencia inválida a una estructura del sistema de archivos. Un atacante podría explotar esta vulnerabilidad para causar que grub falle, lo que lleva a una denegación de servicio. No se descarta un posible compromiso de la integridad o confidencialidad de los datos.

Information

Published : 2025-11-18 19:15

Updated : 2026-10-18 20:10

NVD link : CVE-2025-54771

Mitre link : CVE-2025-54771

CVE.ORG link : CVE-2025-54771

JSON object : View

Products Affected

No product.

CWE

CWE-825

Expired Pointer Dereference

{"id": "CVE-2025-54771", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-54771", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-19T14:17:17.793635Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 1.4}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"vendor": "GNU", "product": "grub2", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.14"}], "packageName": "grub2", "collectionURL": "https://git.savannah.gnu.org/git/grub.git", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:10"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "packageName": "grub2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:7"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "packageName": "grub2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "packageName": "grub2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "packageName": "grub2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "packageName": "openshift/ose-rhel-coreos-8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "packageName": "openshift/ose-rhel-coreos-9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2025-11-18T19:15:49.420", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2025-54771", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2413823", "source": "secalert@redhat.com"}, {"url": "https://lists.gnu.org/archive/html/grub-devel/2025-11/msg00155.html", "source": "secalert@redhat.com"}, {"url": "http://www.openwall.com/lists/oss-security/2025/11/18/3", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-825"}]}], "descriptions": [{"lang": "en", "value": "A use-after-free vulnerability has been identified in the GNU GRUB (Grand Unified Bootloader). The flaw occurs because the file-closing process incorrectly retains a memory pointer, leaving an invalid reference to a file system structure. An attacker could exploit this vulnerability to cause grub to crash, leading to a Denial of Service. Possible data integrity or confidentiality compromise is not discarded."}, {"lang": "es", "value": "Una vulnerabilidad de uso despu\u00e9s de liberaci\u00f3n ha sido identificada en GNU GRUB (Grand Unified Bootloader). El fallo ocurre porque el proceso de cierre de archivos retiene incorrectamente un puntero de memoria, dejando una referencia inv\u00e1lida a una estructura del sistema de archivos. Un atacante podr\u00eda explotar esta vulnerabilidad para causar que grub falle, lo que lleva a una denegaci\u00f3n de servicio. No se descarta un posible compromiso de la integridad o confidencialidad de los datos."}], "lastModified": "2026-10-18T20:10:00.110", "sourceIdentifier": "secalert@redhat.com"}