CVE-2025-61662: Grub2: missing unregister call for gettext command may lead to use-after-free
A Use-After-Free vulnerability has been discovered in GRUB's gettext module. This flaw stems from a programming error where the gettext command remains registered in memory after its module is unloaded. An attacker can exploit this condition by invoking the orphaned command, causing the application to access a memory location that is no longer valid. An attacker could exploit this vulnerability to cause grub to crash, leading to a Denial of Service. Possible data integrity or confidentiality compromise is not discarded.
Other sources
Grub2: missing unregister call for gettext command may lead to use-after-free
— Microsoft
The gettext command is registered in the gettext module during load. However, the command is not unregistered at the module unload. So, this may lead to use-after-free issue when the gettext command is invoked after the gettext module unload.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-61662?
CVE-2025-61662 is classified as a high-severity Use-After-Free vulnerability.
How do I fix CVE-2025-61662?
To fix CVE-2025-61662, update GNU GRUB to the latest version that addresses this vulnerability.
What type of vulnerability is CVE-2025-61662?
CVE-2025-61662 is a Use-After-Free vulnerability affecting the gettext module in GRUB.
What can an attacker do with CVE-2025-61662?
An attacker can exploit CVE-2025-61662 by invoking the orphaned gettext command, potentially leading to arbitrary code execution.
Which software is affected by CVE-2025-61662?
CVE-2025-61662 affects the GNU GRUB bootloader, specifically its gettext module.