CVE-2025-61663

A vulnerability has been identified in the GRUB2 bootloader's normal command that poses an immediate Denial of Service (DoS) risk. This flaw is a Use-after-Free issue, caused because the normal command is not properly unregistered when the module is unloaded. An attacker who can execute this command can force the system to access memory locations that are no longer valid. Successful exploitation leads directly to system instability, which can result in a complete crash and halt system availability. Impact on the data integrity and confidentiality is also not discarded.

CVSS v3 4.9 MEDIUM

4.9^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.4 / Impact : 3.4

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References

Link	Resource
https://access.redhat.com/security/cve/CVE-2025-61663
https://bugzilla.redhat.com/show_bug.cgi?id=2414684

Configurations

No configuration.

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad ha sido identificada en el comando normal del gestor de arranque GRUB2 que plantea un riesgo inmediato de denegación de servicio (DoS). Este defecto es un problema de uso después de liberación, causado porque el comando normal no se anula el registro correctamente cuando el módulo se descarga. Un atacante que puede ejecutar este comando puede forzar al sistema a acceder a ubicaciones de memoria que ya no son válidas. La explotación exitosa conduce directamente a la inestabilidad del sistema, lo que puede resultar en un fallo completo y detener la disponibilidad del sistema. El impacto en la integridad y confidencialidad de los datos tampoco se descarta.

Information

Published : 2025-11-18 19:15

Updated : 2026-10-18 20:10

NVD link : CVE-2025-61663

Mitre link : CVE-2025-61663

CVE.ORG link : CVE-2025-61663

JSON object : View

Products Affected

No product.

CWE

CWE-825

Expired Pointer Dereference

{"id": "CVE-2025-61663", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-61663", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-19T14:27:28.138197Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "secalert@redhat.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 1.4}]}, "affected": [{"source": "secalert@redhat.com", "affectedData": [{"vendor": "GNU", "product": "grub2", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.14"}], "packageName": "grub2", "collectionURL": "https://git.savannah.gnu.org/git/grub.git", "defaultStatus": "unaffected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:10"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 10", "packageName": "grub2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:7"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 7", "packageName": "grub2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:8"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 8", "packageName": "grub2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/o:redhat:enterprise_linux:9"], "vendor": "Red Hat", "product": "Red Hat Enterprise Linux 9", "packageName": "grub2", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "packageName": "openshift/ose-rhel-coreos-8", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}, {"cpes": ["cpe:/a:redhat:openshift:4"], "vendor": "Red Hat", "product": "Red Hat OpenShift Container Platform 4", "packageName": "openshift/ose-rhel-coreos-9", "collectionURL": "https://access.redhat.com/downloads/content/package-browser/", "defaultStatus": "affected"}]}], "published": "2025-11-18T19:15:50.387", "references": [{"url": "https://access.redhat.com/security/cve/CVE-2025-61663", "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2414684", "source": "secalert@redhat.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "secalert@redhat.com", "description": [{"lang": "en", "value": "CWE-825"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been identified in the GRUB2 bootloader's normal command that poses an immediate Denial of Service (DoS) risk. This flaw is a Use-after-Free issue, caused because the normal command is not properly unregistered when the module is unloaded. An attacker who can execute this command can force the system to access memory locations that are no longer valid. Successful exploitation leads directly to system instability, which can result in a complete crash and halt system availability. Impact on the data integrity and confidentiality is also not discarded."}, {"lang": "es", "value": "Una vulnerabilidad ha sido identificada en el comando normal del gestor de arranque GRUB2 que plantea un riesgo inmediato de denegaci\u00f3n de servicio (DoS). Este defecto es un problema de uso despu\u00e9s de liberaci\u00f3n, causado porque el comando normal no se anula el registro correctamente cuando el m\u00f3dulo se descarga. Un atacante que puede ejecutar este comando puede forzar al sistema a acceder a ubicaciones de memoria que ya no son v\u00e1lidas. La explotaci\u00f3n exitosa conduce directamente a la inestabilidad del sistema, lo que puede resultar en un fallo completo y detener la disponibilidad del sistema. El impacto en la integridad y confidencialidad de los datos tampoco se descarta."}], "lastModified": "2026-10-18T20:10:00.110", "sourceIdentifier": "secalert@redhat.com"}