Is CVE-2025-61661 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-61661 being exploited in the wild.

How severe is CVE-2025-61661?

Medium severity, with a CVSS score of 4.8, published 18 November 2025.

Which products and versions are affected?

GNU Project GRUB2 All versions prior to November 2025 patches.

Is there a fix for CVE-2025-61661?

A patch was published on 2025-11-18: Security patches submitted to GRUB development list Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-61661 attacked?

It is attacked with physical access, in an operating system.

Am I affected by CVE-2025-61661?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-61661: GNU GRUB2 out-of-bounds write in grub_usb_get_string

CVE-2025-61661 · Severity: medium · CVSS 4.8 · Published 2025-11-18

A vulnerability in the GRUB bootloader, which is used to start many Linux-based operating systems, could allow an attacker with physical access to crash a system. By plugging in a specially crafted USB device during the boot process, an attacker can trigger a memory error that causes the computer to stop responding or potentially corrupt data. This issue primarily impacts system availability during the startup phase.

Quick answers

Is CVE-2025-61661 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-61661 being exploited in the wild.
How severe is CVE-2025-61661?: Medium severity, with a CVSS score of 4.8, published 18 November 2025.
Which products and versions are affected?: GNU Project GRUB2 All versions prior to November 2025 patches.
Is there a fix for CVE-2025-61661?: A patch was published on 2025-11-18: Security patches submitted to GRUB development list Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-61661 attacked?: It is attacked with physical access, in an operating system.
Am I affected by CVE-2025-61661?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A heap-based buffer overflow exists in GRUB2's 'grub_usb_get_string()' function within 'grub-core/commands/usbtest.c'. The vulnerability is caused by a time-of-check to time-of-use (TOCTOU) style inconsistency where the bootloader uses an initial length value from a USB descriptor for memory allocation, but subsequently uses a different length value from a second read during the UTF-16 to UTF-8 conversion. A local, physical attacker can connect a malicious USB device that provides inconsistent length descriptors to trigger an out-of-bounds write. This can result in a system crash (Denial of Service) or potentially limited data corruption. Patches have been developed to ensure the allocation and conversion use the same validated length field.

Affected products

GNU Project GRUB2 All versions prior to November 2025 patches

Timeline

2025-11-10: other: Issue reported to Red Hat Bugzilla
2025-11-18: disclosed: Public disclosure and CVE assignment
2025-11-18: patched: Security patches submitted to GRUB development list

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.