# CVE-2025-61662: GNU GRUB use-after-free in gettext module

Source: https://junglewise.ai/threats/cve-2025-61662-gnu-grub-use-after-free-in-gettext-module  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-18. Updated: 2026-05-20  
License: CC BY 4.0 with a link back

CVE-2025-61662 · Severity: high · CVSS 7.8 · Published 2025-11-18

A vulnerability has been found in the GRUB bootloader, which is the software responsible for starting up many Linux-based computers. A programming error allows a specific command to remain active in memory even after its associated module has been removed. A local attacker could use this to crash the system or potentially gain unauthorized access to sensitive data during the boot process.

Technologies: [Gnu Grub2](https://junglewise.ai/threats/technologies/grub2). Vendors: [Gnu](https://junglewise.ai/threats/vendors/gnu).

## Quick answers

**Is CVE-2025-61662 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-61662 being exploited in the wild.

**How severe is CVE-2025-61662?** High severity, with a CVSS score of 7.8, published 18 November 2025.

**Which products and versions are affected?** Gnu Grub2 up to and including 2.14.

**Is there a fix for CVE-2025-61662?** A patch was published on 2026-04-30: Red Hat released security updates for OpenShift 4.16 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-61662 attacked?** It is attacked with local access, in an operating system.

**Am I affected by CVE-2025-61662?** Check whether you run Gnu Grub2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Use-After-Free (UAF) vulnerability exists in the GRUB2 gettext module due to a missing unregister call. When the gettext module is unloaded, the 'gettext' command remains registered in the system's command list. If a local attacker subsequently invokes this orphaned command, GRUB attempts to access memory that has already been freed. This can lead to a system crash (Denial of Service) or potentially more severe impacts such as arbitrary code execution or information disclosure. The vulnerability is tracked as CWE-416 and requires local access to the GRUB environment to exploit. Patching is available through various vendor updates, including Red Hat Enterprise Linux and OpenShift.

## Affected products

- GNU grub2 up to and including 2.14
- Red Hat Enterprise Linux
- Red Hat OpenShift Container Platform

## Timeline

- 2025-11-18: disclosed: Vulnerability disclosed in oss-security mailing list
- 2025-11-18: advisory: Initial NVD publication
- 2026-04-30: patched: Red Hat released security updates for OpenShift 4.16
- 2026-05-13: patched: Red Hat released security updates for OpenShift 4.15

## References

- [https://access.redhat.com/errata/RHSA-2026:10097](https://access.redhat.com/errata/RHSA-2026:10097)
- [https://access.redhat.com/errata/RHSA-2026:14773](https://access.redhat.com/errata/RHSA-2026:14773)
- [https://access.redhat.com/errata/RHSA-2026:15087](https://access.redhat.com/errata/RHSA-2026:15087)
- [https://access.redhat.com/errata/RHSA-2026:17596](https://access.redhat.com/errata/RHSA-2026:17596)
- [https://access.redhat.com/errata/RHSA-2026:4648](https://access.redhat.com/errata/RHSA-2026:4648)
- [https://access.redhat.com/errata/RHSA-2026:4649](https://access.redhat.com/errata/RHSA-2026:4649)
- [https://access.redhat.com/errata/RHSA-2026:4652](https://access.redhat.com/errata/RHSA-2026:4652)

## Related threats

- [GNU GRUB2 use after free in normal_exit command](https://junglewise.ai/threats/cve-2025-61664-gnu-grub2-use-after-free-in-normal-exit-command)
- [GNU GRUB use-after-free in grub_file_close](https://junglewise.ai/threats/cve-2025-54771-gnu-grub-use-after-free-in-grub-file-close)
- [GNU GRUB2 Use-after-Free in net_set_vlan command](https://junglewise.ai/threats/cve-2025-54770-gnu-grub2-use-after-free-in-net-set-vlan-command)