Quick answers
- Is CVE-2025-61664 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-61664 being exploited in the wild.
- How severe is CVE-2025-61664?
- Medium severity, with a CVSS score of 4.9, published 18 November 2025.
- Which products and versions are affected?
- Gnu Grub2 All versions prior to November 2025 security patches.
- Is there a fix for CVE-2025-61664?
- A patch was published on 2025-11-18: Upstream patches committed to GRUB2 repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2025-61664 attacked?
- It is attacked with local access, in an operating system.
- Am I affected by CVE-2025-61664?
- Check whether you run Gnu Grub2 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A Use-After-Free (UAF) vulnerability exists in the GRUB2 bootloader within the 'normal' module. The root cause is a failure to unregister the 'normal_exit' command during module unloading. An attacker with the ability to execute GRUB commands (typically via local access or a compromised boot environment) can invoke the command after its parent module has been removed from memory. This leads to an expired pointer dereference (CWE-825), potentially resulting in a system crash, arbitrary code execution, or bypass of boot-time security restrictions. Patches have been released upstream in the GRUB2 git repository, and full mitigation in Secure Boot environments may require updated shim/SBAT revocations.
Affected products
- GNU GRUB2 All versions prior to November 2025 security patches
Timeline
- 2025-11-12: other: Reported to Red Hat Bugzilla
- 2025-11-18: disclosed: Public disclosure and upstream patches released
- 2025-11-18: patched: Upstream patches committed to GRUB2 repository