CVE-2025-4002CWE-404CWE-476

RefindPlusRepo RefindPlus BootLog.c GetDebugLogFile null pointer dereference

Medium · published April 28, 2025

CVSS v4.0
6.8
EPSS
0%
Percentile
9.0
In the wild
Unconfirmed
What it is

A vulnerability was found in RefindPlusRepo RefindPlus 0.14.2.AB and classified as problematic. Affected by this issue is the function GetDebugLogFile of the file Library/MemLogLib/BootLog.c. The manipulation leads to null pointer dereference. Attacking locally is a requirement. The patch is identified as d2143a1e2deefddd9b105fb7160763c4f8d47ea2. It is recommended to apply a patch to fix this issue.

The record
Technical detail
CVSS v4.0
6.8 · MEDIUM
Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00198 · 9.0th percentile
Weaknesses
CWE-404 · Improper Resource Shutdown or Release; CWE-476 · NULL Pointer Dereference
Published
2025-04-28T05:00Z
EPSS history
Timeline
  • 28 APR 05:00Z
    RefindPlusRepo RefindPlus BootLog.c GetDebugLogFile null pointer dereference
    cvelistv5