Medium severity · published Nov 18, 2025
CVE-2025-61664
Grub2: missing unregister call for normal_exit command may lead to use-after-free
4.9
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability in the GRUB2 bootloader has been identified in the normal module. This flaw, a memory Use After Free issue, occurs because the normal_exit command is not properly unregistered when its related module is unloaded. An attacker can exploit this condition by invoking the command after the module has been removed, causing the system to improperly access a previously freed memory location. This leads to a system crash or possible impacts in data confidentiality and integrity.
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Local
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RH
Red Hat Enterprise Linux 10 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 7 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 8 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Enterprise Linux 9 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat OpenShift Container Platform 4 · Red Hat
All versions, or not specified · source: vendor
GR
grub2 · GNU
through 2.14 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-61664
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-61664
access.redhat.com
https://access.redhat.com/security/cve/CVE-2025-61664
bugzilla.redhat.com
https://bugzilla.redhat.com/show_bug.cgi?id=2414685
lists.gnu.org
https://lists.gnu.org/archive/html/grub-devel/2025-11/msg00155.html
More from grub2
8.8
CVE-2024-56737
GNU GRUB (aka GRUB2) through 2.12 has a heap-based buffer overflow in fs/hfs.c via crafted sblock data in an HFS filesystem
8.6
CVE-2022-2601
A buffer overflow was found in grub_font_construct_glyph()
8.2
CVE-2021-20233
A flaw was found in grub2 in versions prior to 2.06
8.2
CVE-2020-25632
A flaw was found in grub2 in versions prior to 2.06
8.2
CVE-2020-10713
A flaw was found in grub2, prior to version 2.06
