# CVE-2025-54771: GNU GRUB use-after-free in grub_file_close

Source: https://junglewise.ai/threats/cve-2025-54771-gnu-grub-use-after-free-in-grub-file-close  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-18. Updated: 2026-05-19  
License: CC BY 4.0 with a link back

CVE-2025-54771 · Severity: medium · CVSS 4.9 · Published 2025-11-18

A vulnerability has been found in the GNU GRUB bootloader, the software responsible for starting a computer's operating system. The flaw occurs when the system closes files, potentially allowing the software to crash or behave unpredictably. This could lead to a denial of service or, in some cases, allow an attacker to compromise the integrity of the boot process.

Technologies: [Gnu Grub2](https://junglewise.ai/threats/technologies/grub2). Vendors: [Gnu](https://junglewise.ai/threats/vendors/gnu).

## Quick answers

**Is CVE-2025-54771 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-54771 being exploited in the wild.

**How severe is CVE-2025-54771?** Medium severity, with a CVSS score of 4.9, published 18 November 2025.

**Which products and versions are affected?** GNU GRUB2.

**Is there a fix for CVE-2025-54771?** A patch was published on 2025-11-18: Security patches released upstream Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-54771 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2025-54771?** Check whether you run Gnu Grub2. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A use-after-free vulnerability exists in the grub_file_close() function of GNU GRUB. The root cause is a failure to properly manage filesystem reference counts; specifically, the code may attempt to access the filesystem structure after its associated module has been dereferenced via grub_dl_unref(). An attacker with local access could exploit this flaw to trigger a crash (Denial of Service) or potentially achieve more complex memory corruption. The vulnerability is addressed by reordering the closing sequence to ensure grub_dl_unref() is called only after the filesystem-specific close operation is complete. Patches have been released by the GRUB maintainers and are being integrated by Linux distributions.

## Affected products

- GNU GRUB2

## Timeline

- 2025-11-10: other: Reported to Red Hat Bugzilla
- 2025-11-18: disclosed: Public disclosure via oss-security and GNU mailing lists
- 2025-11-18: patched: Security patches released upstream

## References

- [https://access.redhat.com/security/cve/CVE-2025-54771](https://access.redhat.com/security/cve/CVE-2025-54771)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2413823](https://bugzilla.redhat.com/show_bug.cgi?id=2413823)
- [https://lists.gnu.org/archive/html/grub-devel/2025-11/msg00155.html](https://lists.gnu.org/archive/html/grub-devel/2025-11/msg00155.html)
- [http://www.openwall.com/lists/oss-security/2025/11/18/3](http://www.openwall.com/lists/oss-security/2025/11/18/3)

## Related threats

- [GNU GRUB2 use after free in normal_exit command](https://junglewise.ai/threats/cve-2025-61664-gnu-grub2-use-after-free-in-normal-exit-command)
- [GNU GRUB use-after-free in gettext module](https://junglewise.ai/threats/cve-2025-61662-gnu-grub-use-after-free-in-gettext-module)
- [GNU GRUB2 Use-after-Free in net_set_vlan command](https://junglewise.ai/threats/cve-2025-54770-gnu-grub2-use-after-free-in-net-set-vlan-command)