CVE-2025-54771
Medium · 4.9CVSS
4.9
EPSS
0.2%
Published
Nov 18, 2025
CISA due date
—
The record
A use-after-free vulnerability has been identified in the GNU GRUB (Grand Unified Bootloader). The flaw occurs because the file-closing process incorrectly retains a memory pointer, leaving an invalid reference to a file system structure. An attacker could exploit this vulnerability to cause grub to crash, leading to a Denial of Service. Possible data integrity or confidentiality compromise is not discarded.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise Micro 5.2 | grub2 | 0 | 2.04-150300.22.61.1 |
| SUSE:Linux Enterprise Micro 5.5 | grub2 | 0 | 2.06-150500.29.59.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | grub2 | 0 | 2.12-150600.8.44.2 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | grub2 | 0 | 2.12-150700.19.19.1 |
| SUSE:Linux Enterprise Module for Server Applications 15 SP6 | grub2 | 0 | 2.12-150600.8.44.2 |
| SUSE:Linux Enterprise Module for Server Applications 15 SP7 | grub2 | 0 | 2.12-150700.19.19.1 |
| openSUSE:Leap 15.6 | grub2 | 0 | 2.12-150600.8.44.2 |
| openSUSE:Leap 16.0 | grub2 | 0 | 2.12-160000.3.1 |
| openSUSE:Tumbleweed | grub2 | 0 | 2.12-67.1 |
Related vulnerabilities
- CVE-2025-61664 A vulnerability in the GRUB2 bootloader has been identified in the normal module. Also affects grub2
- CVE-2025-61663 A vulnerability has been identified in the GRUB2 bootloader's normal command that poses… Also affects grub2
- CVE-2025-61662 A Use-After-Free vulnerability has been discovered in GRUB's gettext module. Also affects grub2
- CVE-2025-61661 A vulnerability has been identified in the GRUB (Grand Unified Bootloader) component. Also affects grub2
- CVE-2024-56738 GNU GRUB (aka GRUB2) through 2.12 does not use a constant-time algorithm for… Also affects grub2
- CVE-2024-56737 GNU GRUB (aka GRUB2) through 2.12 has a heap-based buffer overflow in fs/hfs.c via… Also affects grub2
- CVE-2023-4692 An out-of-bounds write flaw was found in grub2's NTFS filesystem driver. Also affects grub2
- CVE-2023-4693 An out-of-bounds read flaw was found on grub2's NTFS filesystem driver. Also affects grub2