Is CVE-2025-61663 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-61663 being exploited in the wild.

How severe is CVE-2025-61663?

Medium severity, with a CVSS score of 4.9, published 18 November 2025.

Which products and versions are affected?

GNU grub2 <= 2.14; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9; and 3 more.

Is there a fix for CVE-2025-61663?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2025-61663 attacked?

It is attacked with local access, in an operating system.

Am I affected by CVE-2025-61663?

Check whether you run GNU Project GRUB 2, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7 or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-61663: GNU GRUB2 Use-after-Free in normal command module

Q: Which products and versions are affected?

GNU grub2 <= 2.14; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9; and 3 more.

Q: Is there a fix for CVE-2025-61663?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2025-61663 attacked?

It is attacked with local access, in an operating system.

Q: Am I affected by CVE-2025-61663?

Check whether you run GNU Project GRUB 2, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7 or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-61663 · Severity: medium · CVSS 4.9 · Published 2025-11-18

A vulnerability in the GRUB2 bootloader, a critical component used to start Linux-based operating systems, could allow an attacker to crash the system. By triggering a specific error in how the bootloader manages its internal commands, the system may attempt to access invalid memory, leading to an immediate shutdown or instability. This primarily impacts the availability of the server or device, potentially disrupting operations or requiring manual intervention to recover.

Technologies: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat In-Vehicle Operating System 1, Red Hat OpenShift Container Platform 4. Vendors: GNU Project, Red Hat.

Quick answers

Is CVE-2025-61663 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-61663 being exploited in the wild.
How severe is CVE-2025-61663?: Medium severity, with a CVSS score of 4.9, published 18 November 2025.
Which products and versions are affected?: GNU grub2 <= 2.14; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9; and 3 more.
Is there a fix for CVE-2025-61663?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2025-61663 attacked?: It is attacked with local access, in an operating system.
Am I affected by CVE-2025-61663?: Check whether you run GNU Project GRUB 2, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7 or one of the others listed. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Use-after-Free (UAF) vulnerability exists in GRUB2 due to an expired pointer dereference (CWE-825). The 'normal' command is registered when the corresponding module is loaded but is not correctly unregistered during module unloading. An attacker with the ability to execute commands within the GRUB2 environment can trigger this flaw by invoking the command after the module has been unloaded. This causes the bootloader to access memory locations that are no longer valid, resulting in system instability, a complete crash (Denial of Service), and potential minor impacts on data integrity or confidentiality. The vulnerability is tracked by Red Hat as having a medium severity with a local attack vector and high complexity.

Affected products

GNU grub2 <= 2.14
Red Hat Red Hat Enterprise Linux 7
Red Hat Red Hat Enterprise Linux 8
Red Hat Red Hat Enterprise Linux 9
Red Hat Red Hat Enterprise Linux 10
Red Hat Red Hat OpenShift Container Platform 4
Red Hat Red Hat In-Vehicle Operating System 1

Timeline

2025-11-12: other: Bug reported to Red Hat Bugzilla
2025-11-18: disclosed: CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.