Junglewise Threat Intelligence

CVE-2025-61662: GNU GRUB use-after-free in gettext module

CVE-2025-61662 · Severity: high · CVSS 7.8 · Published 2025-11-18

Technologies: Gnu Grub2, Red Hat Enterprise Linux. Vendors: Red Hat, Gnu.

Executive brief

A vulnerability has been found in the GRUB bootloader, which is the software responsible for starting up many Linux-based computers. A programming error allows a specific command to remain active in memory even after its associated module has been removed. A local attacker could use this to crash the system or potentially gain unauthorized access to sensitive data during the boot process.

Technical details

A Use-After-Free (UAF) vulnerability exists in the GRUB2 gettext module due to a missing unregister call. When the gettext module is unloaded, the 'gettext' command remains registered in the system's command list. If a local attacker subsequently invokes this orphaned command, GRUB attempts to access memory that has already been freed. This can lead to a system crash (Denial of Service) or potentially more severe impacts such as arbitrary code execution or information disclosure. The vulnerability is tracked as CWE-416 and requires local access to the GRUB environment to exploit. Patching is available through various vendor updates, including Red Hat Enterprise Linux and OpenShift.

Affected products

  • GNU grub2 up to and including 2.14
  • Red Hat Enterprise Linux
  • Red Hat OpenShift Container Platform

Timeline

  • 2025-11-18: disclosed: Vulnerability disclosed in oss-security mailing list
  • 2025-11-18: advisory: Initial NVD publication
  • 2026-04-30: patched: Red Hat released security updates for OpenShift 4.16
  • 2026-05-13: patched: Red Hat released security updates for OpenShift 4.15

References

Related threats