CVE-2025-61661

A vulnerability has been identified in the GRUB (Grand Unified Bootloader) component. This flaw occurs because the bootloader mishandles string conversion when reading information from a USB device, allowing an attacker to exploit inconsistent length values. A local attacker can connect a maliciously configured USB device during the boot sequence to trigger this issue. A successful exploitation may lead GRUB to crash, leading to a Denial of Service. Data corruption may be also possible, although given the complexity of the exploit the impact is most likely limited.

CVSS v3 4.8 MEDIUM

4.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.5 / Impact : 4.2

Attack Vector PHYSICAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2025-61661
https://bugzilla.redhat.com/show_bug.cgi?id=2413827
http://www.openwall.com/lists/oss-security/2025/11/18/8

Configurations

No configuration.

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad ha sido identificada en el componente GRUB (Grand Unified Bootloader). Este problema ocurre porque el gestor de arranque maneja incorrectamente la conversión de cadenas al leer información de un dispositivo USB, permitiendo a un atacante explotar valores de longitud inconsistentes. Un atacante local puede conectar un dispositivo USB configurado maliciosamente durante la secuencia de arranque para desencadenar este problema. Una explotación exitosa puede provocar que GRUB se bloquee, lo que lleva a una denegación de servicio. La corrupción de datos también puede ser posible, aunque dada la complejidad del exploit el impacto es muy probablemente limitado.

Information

Published : 2025-11-18 19:15

Updated : 2026-10-18 20:10

NVD link : CVE-2025-61661

Mitre link : CVE-2025-61661

CVE.ORG link : CVE-2025-61661

JSON object : View

Products Affected

No product.

CWE

CWE-131

Incorrect Calculation of Buffer Size

{"id": "CVE-2025-61661", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-61661", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-19T14:18:04.440314Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.2, "exploitabilityScore": 0.5}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"vendor": "GNU", "product": "grub2", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.14"}], "packageName": "grub2", "collectionURL": "https://git.savannah.gnu.org/git/grub.git", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:10"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "packageName": "grub2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:7"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "packageName": "grub2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "packageName": "grub2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "packageName": "grub2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "packageName": "openshift/ose-rhel-coreos-8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "packageName": "openshift/ose-rhel-coreos-9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2025-11-18T19:15:49.973", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2025-61661", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2413827", "source": "secalert@redhat.com"}, {"url": "http://www.openwall.com/lists/oss-security/2025/11/18/8", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-131"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in the GRUB (Grand Unified Bootloader) component. This flaw occurs because the bootloader mishandles string conversion when reading information from a USB device, allowing an attacker to exploit inconsistent length values. A local attacker can connect a maliciously configured USB device during the boot sequence to trigger this issue. A successful exploitation may lead GRUB to crash, leading to a Denial of Service. Data corruption may be also possible, although given the complexity of the exploit the impact is most likely limited."}, {"lang": "es", "value": "Una vulnerabilidad ha sido identificada en el componente GRUB (Grand Unified Bootloader). Este problema ocurre porque el gestor de arranque maneja incorrectamente la conversi\u00f3n de cadenas al leer informaci\u00f3n de un dispositivo USB, permitiendo a un atacante explotar valores de longitud inconsistentes. Un atacante local puede conectar un dispositivo USB configurado maliciosamente durante la secuencia de arranque para desencadenar este problema. Una explotaci\u00f3n exitosa puede provocar que GRUB se bloquee, lo que lleva a una denegaci\u00f3n de servicio. La corrupci\u00f3n de datos tambi\u00e9n puede ser posible, aunque dada la complejidad del exploit el impacto es muy probablemente limitado."}], "lastModified": "2026-10-18T20:10:00.110", "sourceIdentifier": "secalert@redhat.com"}