CVE-2025-61661
Medium · 4.8CVSS
4.8
EPSS
0.2%
Published
Nov 18, 2025
CISA due date
—
The record
A vulnerability has been identified in the GRUB (Grand Unified Bootloader) component. This flaw occurs because the bootloader mishandles string conversion when reading information from a USB device, allowing an attacker to exploit inconsistent length values. A local attacker can connect a maliciously configured USB device during the boot sequence to trigger this issue. A successful exploitation may lead GRUB to crash, leading to a Denial of Service. Data corruption may be also possible, although given the complexity of the exploit the impact is most likely limited.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| SUSE:Linux Enterprise Micro 5.2 | grub2 | 0 | 2.04-150300.22.61.1 |
| SUSE:Linux Enterprise Micro 5.5 | grub2 | 0 | 2.06-150500.29.59.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | grub2 | 0 | 2.12-150600.8.44.2 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | grub2 | 0 | 2.12-150700.19.19.1 |
| SUSE:Linux Enterprise Module for Server Applications 15 SP6 | grub2 | 0 | 2.12-150600.8.44.2 |
| SUSE:Linux Enterprise Module for Server Applications 15 SP7 | grub2 | 0 | 2.12-150700.19.19.1 |
| openSUSE:Leap 15.6 | grub2 | 0 | 2.12-150600.8.44.2 |
| openSUSE:Leap 16.0 | grub2 | 0 | 2.12-160000.3.1 |
| openSUSE:Tumbleweed | grub2 | 0 | 2.12-67.1 |
Related vulnerabilities
- CVE-2025-61664 A vulnerability in the GRUB2 bootloader has been identified in the normal module. Also affects grub2
- CVE-2025-61663 A vulnerability has been identified in the GRUB2 bootloader's normal command that poses… Also affects grub2
- CVE-2025-61662 A Use-After-Free vulnerability has been discovered in GRUB's gettext module. Also affects grub2
- CVE-2025-54771 A use-after-free vulnerability has been identified in the GNU GRUB (Grand Unified… Also affects grub2
- CVE-2024-56738 GNU GRUB (aka GRUB2) through 2.12 does not use a constant-time algorithm for… Also affects grub2
- CVE-2024-56737 GNU GRUB (aka GRUB2) through 2.12 has a heap-based buffer overflow in fs/hfs.c via… Also affects grub2
- CVE-2023-4692 An out-of-bounds write flaw was found in grub2's NTFS filesystem driver. Also affects grub2
- CVE-2023-4693 An out-of-bounds read flaw was found on grub2's NTFS filesystem driver. Also affects grub2