CVE-2025-61662

A Use-After-Free vulnerability has been discovered in GRUB's gettext module. This flaw stems from a programming error where the gettext command remains registered in memory after its module is unloaded. An attacker can exploit this condition by invoking the orphaned command, causing the application to access a memory location that is no longer valid. An attacker could exploit this vulnerability to cause grub to crash, leading to a Denial of Service. Possible data integrity or confidentiality compromise is not discarded.

CVSS 3.1

7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.2% chance of exploitation in the next 30 days; higher than 12% of CVEs (scores of 2026-10-25)

CWE

CWE-416

Published

2025-11-18

Modified

2026-10-18

Record from

the NVD, synced 2026-10-19

Affected

• gnu:grub2

References

• https://access.redhat.com/errata/RHSA-2026:10097
• https://access.redhat.com/errata/RHSA-2026:14773
• https://access.redhat.com/errata/RHSA-2026:15087
• https://access.redhat.com/errata/RHSA-2026:17596
• https://access.redhat.com/errata/RHSA-2026:4648

Check your stackJSON