Is CVE-2025-61662 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-61662 being exploited in the wild.

How severe is CVE-2025-61662?

High severity, with a CVSS score of 7.8, published 18 November 2025.

Which products and versions are affected?

Gnu Grub2 up to and including 2.14.

Is there a fix for CVE-2025-61662?

A patch was published on 2026-04-30: Red Hat released security updates for OpenShift 4.16 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-61662 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2025-61662?

Check whether you run Gnu Grub2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-61662: GNU GRUB use-after-free in gettext module

CVE-2025-61662 · Severity: high · CVSS 7.8 · Published 2025-11-18

A vulnerability has been found in the GRUB bootloader, which is the software responsible for starting up many Linux-based computers. A programming error allows a specific command to remain active in memory even after its associated module has been removed. A local attacker could use this to crash the system or potentially gain unauthorized access to sensitive data during the boot process.

Technologies: Gnu Grub2. Vendors: Gnu.

Quick answers

Is CVE-2025-61662 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-61662 being exploited in the wild.
How severe is CVE-2025-61662?: High severity, with a CVSS score of 7.8, published 18 November 2025.
Which products and versions are affected?: Gnu Grub2 up to and including 2.14.
Is there a fix for CVE-2025-61662?: A patch was published on 2026-04-30: Red Hat released security updates for OpenShift 4.16 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-61662 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2025-61662?: Check whether you run Gnu Grub2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Use-After-Free (UAF) vulnerability exists in the GRUB2 gettext module due to a missing unregister call. When the gettext module is unloaded, the 'gettext' command remains registered in the system's command list. If a local attacker subsequently invokes this orphaned command, GRUB attempts to access memory that has already been freed. This can lead to a system crash (Denial of Service) or potentially more severe impacts such as arbitrary code execution or information disclosure. The vulnerability is tracked as CWE-416 and requires local access to the GRUB environment to exploit. Patching is available through various vendor updates, including Red Hat Enterprise Linux and OpenShift.

Affected products

GNU grub2 up to and including 2.14
Red Hat Enterprise Linux
Red Hat OpenShift Container Platform

Timeline

2025-11-18: disclosed: Vulnerability disclosed in oss-security mailing list
2025-11-18: advisory: Initial NVD publication
2026-04-30: patched: Red Hat released security updates for OpenShift 4.16
2026-05-13: patched: Red Hat released security updates for OpenShift 4.15

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.